Tag Info

New answers tagged

6

Is the TCP port SQL Server is listening on open globally? If so, yes I'd be concerned. If there is a password that can be brute-forced or guessed, or an exploit that allows someone to bypass authentication, eventually your database could be compromised. You'll also be vulnerable to attacks that don't require access, such as someone filling up the drive that ...


5

SQL Server runs locally with IIS to serve its websites The main problem I see is having sql server and IIS running on the same server. IIS serves website and SQL Server should be on a different server and only allowed connection from IIS to SQLServer. There are things that you can do to mitigate the problem: Change SQL Server port away from default ...


6

So the IIS on this server is intended to be externally accessible from your internal data network but the SQL Server instance on this same server is not meant to allow for external connections except for only through the web interfaces of your applications, correct? If so, then is not adding an explicit rule in the Windows Firewall on this server to allow ...


1

As in the other answers: you need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404: Cumulative Update 8 for SQL Server 2014 Cumulative Update 1 for SQL Server 2014 SP1 Cumulative Update 6 for SQL Server 2012 SP2 Cumulative Update 7 for SQL Server 2014 After enabling only TLS 1.2 you will possibly encounter two errors: SQL ...


2

I think this is what you need. select s.job_id ,s.name as [job_name] ,js.step_id ,js.step_name ,js.subsystem ,js.proxy_id ,js.command , c.credential_identity from sysjobs S INNER JOIN sysjobsteps JS ON S.job_id = js.job_id INNER JOIN sysproxies p ON js.proxy_id = p.proxy_id INNER JOIN sys.credentials as c on ...


0

Just create a procedure on the target schema which involves EXECUTE_IMMEDIATE to create tables (check for other DDLs!!). Then grant the source schema privilege to execute on procedure. This should do the trick without security concerns.


0

Please find the below 4 queries and run these queries from system database. //For seeing Full user details SELECT profile FROM dba_users WHERE username = 'SYSTEM'; //This query is used to change the password life time to unlimited ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED; //This query is used to chagne the default password. alter user ...


0

You can setup replication using SSL. With an unencrypted connection between the MySQL client and the server, someone with access to the network could watch all your traffic and look at the data being sent or received, or even change the data while it is in transit between client and server. When you must move information over a network in a secure ...


1

Stored procedures don't magically prevent SQL injection, but they do make preventing it a heck of a lot easier. All you have to do is something like the following (Postgres example): CREATE OR REPLACE FUNCTION my_func ( IN in_user_id INT ) [snip] SELECT user_id, name, address FROM my_table WHERE user_id = in_user_id; --BAM! SQL INJECTION IMMUNE!! ...


1

Is the new user allowed to send mail on the SMTP server? You can do this: Review this and make sure your setup is valid with the correct user (MSDN Link). Also check the settings in RSreportserver.config (MSDNlink).


2

The group or login that is member of the sysadmin role is indepentent of who owns the database. The login that is mapped to the dbo of the database is basically the owner. You can change this via SSMS or with the query below: ALTER AUTHORIZATION ON DATABASE::[ReportServer] TO [sa]; ALTER AUTHORIZATION ON DATABASE::[ReportServerTempDB] TO [sa]; You can ...


1

dbo is the database owner of the database. This does NOT have to be the same principal in each case. If you look at sys.databases you will see a column owner_sid that has the SID for the owner of each database. This ties back to the sys.server_principals view. FYI you could have the same situation with a user other than dbo. In the end the name of the ...


1

In the Server you can look for exec sp_helpsrvrolemember sysadmin exec sp_helpsrvrolemember dbcreator In the databases that you want exec sp_helprolemember db_datareader exec sp_helprolemember db_datawriter exec sp_helprolemember db_ddladmin exec sp_helprolemember db_owner and all direct permissions exec sp_helprotect null,null


1

dbo is a user in a DB. When a user is created (whatever is name would be), it gets its own unique SID. If you later create a second DB and add a new user with a similar name (or not), it will get another unique SID. Both user on DB1 and DB2 have nothing in common and SID will be different. This was based on the unedited question about ...



Top 50 recent answers are included