New answers tagged

2

Create the procedures with AUTHID DEFINER option (this is the default if you skip this clause) in a schema who has the ALTER USER privilege. Them simply grant execute on these procedures to NOC. NOC does not need any other privileges, as the procedures will run as if their owner would have called them.


0

You can also use scp. Ensure that your local postgres user can ssh passwordlessly to your remote host (ssh-keygen -t dsa) and that its public key (~postgres/.ssh/id_dsa.pub) is included in the remote hosts authorized_keys files (~postgres/.ssh/authorized_keys). Once you (as postgres user) can ssh to the remote host, update the following in your ...


3

In and of itself, no, you are probably not adding a security risk. As long as no one but a sysadmin can alter the procedure and as long as the ONLY thing the procedure can do is start a job I don't see a problem. The risks come in with the fact that MSDB is (and is supposed to be) marked as TRUSTWORTHY. That means that by using EXECUTE AS OWNER you are ...


1

Streaming replication in PostgreSQL uses the same security mechanisms as a normal frontend-backend connection. So in order to encrypt the traffic, SSL should be used, and access control should be set up. Alternatively, or additionally, consider a VPN of some kind. PostgreSQL instances aren't really meant to be run facing the open internet.


4

DB_NAME does not work as advertised before SQL Server 2016 (where the behaviour of DB_ID is also changed). For details, see: Information disclosure with the db_name and db_id function (Connect bug report) There is a similar situation with other metadata functions, including: suser_name suser_sname suser_sid user_id database_principal_id is_rolemember ...


2

Upgrade to a modern version of SQL Server. As the error states, you cannot specify a default schema for a group. You can in SQL Server 2012 and newer.


0

The simple test: postgres=# create schema foo; CREATE SCHEMA postgres=# create table foo.t(x int); CREATE TABLE postgres=# create role foomaster nosuperuser nologin inherit; CREATE ROLE postgres=# create role fooslave password '111' login inherit in role foomaster; CREATE ROLE postgres=# grant usage on schema foo to foomaster; GRANT postgres=# set role ...


0

Well... It seems that there is no way to implement auth unless I use mysqldump but finally I found an alternative way to secure my SST using certificate and private key. Just self-sign a CA, and create a server private key and certificate, add them to wsrep_provider_options and everything is done. The attackers cannot retrieve a copy of SST as he cannot ...


-1

You wanna do this (i think): GRANT SELECT, INSERT ON id.testtable TO GROUP NewGroup; "To group" is mandatory in that case.


2

According to the question all you need to do is attach a predicate on query to customer table as shown below. select * from customer where company_id in(select company_id from user_info where Admin='admin_user'); Right? So you have to create a function which should return a predicate as: company_id in(select company_id from user_info where ...


4

Just change ownership for starters. Database ownership (the owner_sid in sys.databases) not have really have much impact on day to day operations


2

The two most common scenarios for security via a linked-server are: Create a SQL login on the target SQL Server, and use that login in the definition of the linked server. You then GRANT and DENY access to that login on the target server objects as necessary, using the principle of least privilege. Define the SQL Server to allow "pass through" ...


0

For some reason these types of users cannot be re-linked using "alter user" as stated in Thomas Stringer answer. By inspection, the SSMS dialog shows "SQL user without login" when the sys.database_principals.authentication_type = 0 or 1 (and possibly others). select * from sys.database_principals where name = 'TempUser'; Noting that brute force does not ...


7

You'll need to determine how the logins have access to run DDL in master. The following query will return a list of logins with server-level role membership: SELECT ServerName = @@SERVERNAME , RoleName = roles.name , MemberName = members.name , IsEnabled = CASE WHEN members.is_disabled = 1 THEN 0 ELSE 1 END FROM sys.server_role_members srm ...


3

Some of what you are asking for is actually pretty simple. Permissions for your AD Group You create a login for your AD group CREATE LOGIN [domain\AD Group] FROM WINDOWS Then grant it the access you want. You say you want to grant it Admin access but unless this is your DBA team I wouldn't add the AD Group to something like sysadmin. Instead grant ...


4

You can grant admin access using this code: CREATE LOGIN [DOMAIN\ADGroupName] FROM WINDOWS; GRANT CONTROL SERVER TO [DOMAIN\ADGroupName]; That will allow any user who is a member of [DOMAIN\ADGroupName] to login to SQL Server without specifying a username/password, and will grant those users admin access to the entire instance, including all databases. ...


3

One way this happens is by having a Login that has the CONTROL SERVER server-level permission (hence does not need an actual USER in order to access a database) but not in the sysadmin fixed server role (as then there is an implied default schema of dbo) create an object without explicitly specifying the schema to put it in. According to the MSDN page for ...


2

The schema of a user who is a member of a Windows Group who has access to the SQL Server database through that Windows Group will become the name of the user automatically. To test this, I just created a group on my local machine named "TestGroup". I added a Windows user "TestUser" to that group. I then did the following on my local instance: CREATE ...



Top 50 recent answers are included