All Questions
Tagged with permissions security
166 questions
0
votes
1
answer
50
views
SQL Server read-only SystemAdmin account
Is there a way to create a sysadmin like account with only read privilege's.
I know that you can give a lot of grants to an account like view server state, view any definition, view any database etc, ...
- 66
0
votes
1
answer
32
views
Disabling Login of a User Who Have Scheduled Jobs to Run in Oracle
I have a custom oracle user(let's say monitor_user) which has lots of procedures and jobs that sends e-mail of query results. But for security reasons i want to disable its login to database from an ...
- 127
1
vote
2
answers
84
views
User can't access a database because he belongs to multiple AD groups
We have an SQL Server 2016 that has 20 different databases on it that are used by different applications and different teams in the company. There are groups of users in Active Directory that combine ...
- 4,690
0
votes
0
answers
79
views
How to prevent user from connecting via SSMS but allow query via .net application connectionstring?
I have been given task to create a SQL login that can be used to query the db via a .net application connection string.
But the user shouldn't be able to connect to SQL via SSMS.
I have created the ...
- 3,489
1
vote
1
answer
56
views
Logical replication security risk with run_as_owner = false
The docs say
If the subscription has been configured with run_as_owner = true, then no user switching will occur. Instead, all operations will be performed with the permissions of the subscription ...
- 305
1
vote
0
answers
30
views
How to securely limit columns in postgres logical replication?
The docs currently have this to say about publications with specified column lists:
The choice of columns can be based on behavioral or performance reasons. However, do not rely on this feature for ...
- 305
1
vote
1
answer
58
views
SAGE ODBC driver - minimum required folder permisions
I have a website which I want to connect to SAGE ACCDATA folder (which resides on a different server but same network to the intranet server) using their proprietary ODBC driver.
For security purposes ...
- 163
1
vote
1
answer
498
views
What is the difference between a securable and permission in SQL Server?
In Microsoft SQL Server you have the possibility to set permissions at server and database level. You are also able to select a server login or database user and then set securables. I am wondering ...
1
vote
0
answers
101
views
remove unix user named postgres after complete uninstallation of postgresql
I'm running MX Linux 21 and recently installed PostgreSQL-13; I wanted postgres to have read, write and execute access to a certain folder therefore I added the unix user postgres to the group of ...
- 111
1
vote
1
answer
74
views
How to list the permissions needed for a role / user to run a query / view successfully (in an automated manner)?
Suppose I have queries / views like this:
select
internal.companies._cid,
internal.companies.name,
src1.employees.year,
src1.employees.count
from internal.companies
join src1....
- 111
1
vote
1
answer
3k
views
Restrict access to a new schema to a specific role despite users having db_datareader?
I'm working in a SQL Server 2016 database that is not of my design nor can I fundamentally change the security structure. I know it is likely trash/worst practice but I have to play the hand I am ...
- 13
0
votes
2
answers
158
views
What can malicious postgres db user do to a linux server?
Suppose I created a db user with
create role myuser login password 'xyz';
and allowed typical read and write db permissions.
If a malicious user finds these login credentials (and has access to db), ...
- 103
0
votes
3
answers
2k
views
Unable to grant membership to public role
I'm trying to refresh my dev db with a snapshot from prod. I've restored the production db from the prod server to my dev server just named as development. I'm trying to grant access to the dev db to ...
- 111
1
vote
1
answer
311
views
Unable to restrict user from built in SQL Server Functions
We have a SQL Server (Standard) database with a user whom we are attempting to restrict permissions to only CRUD Operations to certain tables (CREATE, SELECT, UPDATE, DELETE) and only allow connect ...
- 111
0
votes
2
answers
1k
views
ALTER permission on database allows creation of security principals
It appears the ALTER permission granted at the database level allows the principal to which it is granted, to create security principals in the database.
Consider the below example:
/* setup database *...
- 2,083
-1
votes
1
answer
4k
views
How to query the effective permission of sql login (windows and/or sql user)?
How to query the SQL server to fetch the effective permission of the following SQL logins under the Security/Logins:
SQL user
Windows user
Windows group
- 3,489
1
vote
1
answer
138
views
What is effective permission if windows user is added as login as well as via group membership; with only public permission given via the user login?
Link: https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/determining-effective-database-engine-permissions?view=sql-server-ver15#principals
Remember that a ...
- 3,489
1
vote
1
answer
394
views
How to remove user from login (user is already part of group) and keep the jobs?
I have a sql login for windows group.
One of the members of ths group was also added as a sql login. This user has 1 job in which he is registered as the owner.
I want to remove this user login ...
- 3,489
0
votes
1
answer
134
views
Does deleting the login retain the permissions given via group membership?
I have a windows group account added as login in sql server. The group contains around 100 members.
The above windows group login is given specific database level permissions like db_datareader, ...
- 3,489
0
votes
1
answer
628
views
Explicitly revoke privileges from a user who is a member of a role that is granted those privileges in PostgreSQL
Let's say I have a user on my PostgreSQL instance called "myuser", and I add it to a new group called "update_all" like this:
CREATE ROLE update_all WITH NOLOGIN ROLE myuser;
I ...
-1
votes
2
answers
162
views
Extremely safe Postgres table permissions
Let's say that I have four tables in my Postgres database, two of which are private and contain highly sensitive information (private1 and private2), and two that contain information I want to allow ...
- 99
0
votes
1
answer
165
views
is it safe to grant permission to all users in Microsoft sql server
I have a global production server and database, as I all users should have access to it by remote desktop.
Is it possible to grant NTFS permission on all database files (mdf+ldf files) to all users? ...
0
votes
1
answer
2k
views
How is the "Adjust memory quotas for a process" user right assignment used in SQL Server 2019?
I am looking at the Configure Windows Service Accounts and Permissions doc (https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?...
- 73
1
vote
2
answers
5k
views
How to grant permissions to allow anything inside a SQL Server schema?
I have a schema called training. I have a new role called training_modify. Here are the desired permissions for users placed in that role:
Select, update, insert, and delete permissions on any object ...
1
vote
1
answer
3k
views
SQL Server Grant CRUD to Users on One Schema
I have a schema called training. I want users who will be trained to have CRUD permissions on any object on that schema. I do not want them to have any other permissions on any other object outside ...
11
votes
2
answers
2k
views
Break the link between a Database User and SQL Server Login
When restoring database from once instance to another one sometimes has to relink SQL Server Logins to the Database User.
This is normally achieved with one of the following procedures.
Deprecated ...
- 18.3k
1
vote
1
answer
300
views
Allows to select on view, while hiding its definition
I need to create a user in PostgreSQL with the least privileges possible. So, the user would only be allowed to do queries on specific tables and views. That user should not be allowed to get any ...
- 113
1
vote
1
answer
4k
views
Changing the login name for user dbo
I have a database where the owner is Login1 but the username dbo is assigned to Login - login2. I understand in order to change the login name for the username dbo to sa I will have to use the below
...
- 1,063
0
votes
1
answer
421
views
Does SSRS report user needs database level permission?
I have a separate reporting server and a separate database server. Now on the Reporting server site settings I could see there are some roles and users. Suppose a User BOB has ‘POWER USER’ role ...
- 1,063
5
votes
1
answer
12k
views
How to grant permission to execute stored procedure in master database from another database
Our developers have a domain account used by their application that needs to be able to execute stored procedures created in the master database using the "sp_" naming convention from other databases ...
- 75
3
votes
1
answer
280
views
Allowing non-privileged users to cause privileged code to run
Context:
Our SQL server is used for teaching, and we need to be able to automatically create databases for the students on demand and in real-time. We also need the students to be able to delete ...
- 133
4
votes
2
answers
6k
views
Can SET IDENTITY_INSERT be allowed with less privileges than db_ddladmin?
I've inherited a system where the application is running under sysadmin account.
I limited this account to db_datareader + db_datawriter + EXECUTE on all database and set extended events session to ...
- 11.2k
2
votes
1
answer
1k
views
MySQL least privileges to get database/tables size
I'm using centreon_plugins to monitor some mysql databases. As a best practice I create a dedicated user for monitoring and I give it the least possible privileges.
For simple monitoring I usually ...
- 21
0
votes
1
answer
823
views
Create a user on database A with a procedure from database B (with EXECUTE AS)
I have 2 logins :
LoginA: role dbcreator + CONNECT ANY DATABASE
LoginB: role sysadmin
I have 2 databases :
dbA: everyone has all rights on it
dbB: only LoginB has rights on it, LoginA is only the ...
- 310
3
votes
1
answer
1k
views
How do I grant a SELECT permission to an individual user who's part of a large group that is explicitly denied?
I have a table SuperSecretData which is currently setup to deny SELECT to everyone in the company by the standard Active Directory account "Domain Users". But a couple of specific individual users do ...
- 39.5k
0
votes
3
answers
1k
views
Cascading REVOKE not working in MYSQL
I've read about an SQL option of cascading permissions when issuing a REVOKE statement. I've googled for how this option is implemented in MySQL, but haven't found it at all.
This is the docs page ...
- 285
0
votes
1
answer
186
views
MySQL 8 roles - I'm probably missing something obvious
I'm trying to use roles in MySQL 8, and failing. I have read the documentation and as far as I can tell, I'm doing it right. Since this is a 'hello world' level attempt, I assume I'm missing something ...
- 4,098
1
vote
1
answer
71
views
Prevent updating table using procedure in different database
This is my scenario:
Windows User Gabe has db_owner access of database DB1.
Windows User Gabe has db_reader on database DB2.
When the user executes UPDATE DB2.dbo.Tbl1 SET X = 1, they get "The ...
- 1,336
1
vote
1
answer
172
views
Disallow superusers and single-user mode in POSTGRESQL
I have a doubt about superusers and single-user mode.
I want to restrict the access to a certain database, in a way that only those users which I gave privileges can see the structure of my database. ...
- 13
0
votes
1
answer
431
views
how to script server side permissions - specifically EXECUTE ON SYS.XP_PROP_OLEDB_PROVIDER?
I could not script the following server side permissions:
GRANT VIEW DEFINITION ON LOGIN::[site_helpdesk] TO [Radhe]
but thanks to the question below I found a solution to that:
How to script out ...
- 16.6k
3
votes
1
answer
3k
views
How to grant execute permissions to a stored procedure but not to the underlying databases
I am trying to allow a user to run a stored procedure while restricting them read/write access to the underlying tables. I am able to complete this with other stored procedures, but the one I am ...
- 31
3
votes
4
answers
4k
views
What permissions are required for UPDATE STATISTICS #table WITH ROWCOUNT = xxx?
Can anyone point me to the correct documentation or additional permissions I need besides SA to do the following?
When I run it, I receive the following error:
Cannot find the object "#test" because ...
- 473
4
votes
1
answer
1k
views
Execute Permissions for a Store Procedure that creates databases
I have a Stored Procedure that creates a Database for a specific project which needs to run every month by one of our Data Analysts. The question is how do I structure this to enable the Analyst to ...
- 223
4
votes
1
answer
6k
views
SQL Server impersonation
This question is about impersonation in Microsoft SQL Server. I want to know that if I have impersonation permissions on a specific login then I can easily impersonate that login whenever I want and I ...
0
votes
0
answers
426
views
Column level security in SQL server
Is it possible to assign column level security in SQL Server directly on a table, without using a view?
For example, for table 'tbl', if I want column 1 to be restricted for user 1, is it possible ...
- 131
1
vote
0
answers
2k
views
Grant permissions over linked server
I need to grant select permissions to a sensitive table over the linked server. This table should only grant access to members of an AD group. I currently have other linked servers set up with remote ...
- 373
0
votes
0
answers
48
views
NT SERVICE accounts should be sysadmins? [duplicate]
I have the following query to get me a list of sysadmins in the current server:
select 'ServerRole' = SUSER_NAME(rm.role_principal_id),
'MemberName' = lgn.name ,
'Status'= Case when ...
- 16.6k
0
votes
1
answer
138
views
Audit MariaDB Which User Account Privileges Are Being Used
I'm looking to improve the security of my MariaDB installation by better auditing the user accounts and the privileges of each user account.
This database is being provided as a service out to many ...
- 103
1
vote
1
answer
68
views
Database Reader Role with the ability to Create, View and execute stored procedure's and view's in sql server
I will need to allow report writers on the Subscription database to be able to view the table, create alter and delete stored procedure and views. Since it is a transactional replication they cannot ...
- 1,063
0
votes
1
answer
4k
views
cross database ownership - The server principal is not able to access the database under the current security context
I have this script that set a bunch of databases to the same db owner, and set cross database ownership on at database level
select database_name=name,
db_owner_name=suser_sname(owner_sid),
...
- 16.6k