Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
0
votes
1answer
19 views

Cross Database with Application Role

I have a requirement to access (read) a table/view in database B from database A. The application that needs to execute the query however uses an Application Role. From what I've read and tried, doing ...
1
vote
1answer
31 views

MySQL Password Validation - No previous passwords

I wonder if there is any possibility to use the password validation for MySQL 5.6 (https://dev.mysql.com/doc/refman/5.6/en/validate-password.html) to prevent for example the last 4 passwords. The ...
2
votes
0answers
23 views

Never changing the password for distributor_admin for local instance only?

Per Does distributor_admin need sysadmin? distributor_admin needs SA and per Can the account name of 'distributor_admin' be changed? the name can not be changed. The password is changed with ...
3
votes
1answer
107 views

How do I grant a SELECT permission to an individual user who's part of a large group that is explicitly denied?

I have a table SuperSecretData which is currently setup to deny SELECT to everyone in the company by the standard Active Directory account "Domain Users". But a couple of specific individual users do ...
0
votes
1answer
18 views

Grant User permission to view XE results via sys.fn_xe_file_target_read_file

I need to grant a user (MyDomain\JohnSmith) permission to view one particular XE session results using sys.fn_xe_file_target_read_file I thought the best way to do this would be to encapsulate the ...
0
votes
1answer
42 views

SA account locked out then unlocked somehow

This morning I noticed that our sa sql server account was locked out, and then somehow unlocked. 9/27/2019 5:28:26 AM - Login failed for user 'sa'. Reason: Password did not match that for the login ...
0
votes
1answer
52 views

Data sensitivity classification in SQL Server 2019

Is there any way in SQL Server 2019 to physically partition data by Data Sensitivity Classification and thereby allow different security mechanisms to be used with different sensitivities? New ...
0
votes
1answer
24 views

I am trying to connect My R studio to SQL Database on the Remote Desktop

SQL in the Remote dektop has neigther login nor password, it is in Windows Authentication i am using the Following Code to connect library(DBI) library(RODBC) dbhandle <- odbcDriverConnect('...
0
votes
1answer
11 views

Cascading REVOKE not working in MYSQL

I've read about an SQL option of cascading permissions when issuing a REVOKE statement. I've googled for how this option is implemented in MySQL, but haven't found it at all. This is the docs page ...
0
votes
2answers
56 views

SQL Server 2016: Granting security to do everything but read / write data

We have an offshore support team coming online to support our servers as DBAs for 24x7 support. However, there are several instances that have a limitation due to contracts that limit offshore access ...
1
vote
1answer
11 views

SQL Connector for Azure Key Vault - Cannot use more than one key vault

I am using SQL Server 2016 Enterprise Edition with SQL Connector for Azure Key Vault. I am trying to attach more than one Key Vault to my SQL instance but it is not working. I went through these ...
0
votes
3answers
54 views

Check if a SQL Login exists without SA

How can I check if a SQL Login exists for an arbitrary domain user if the account I'm running doesn't have SA rights to the instance (but will be dbo on at least one DB) Ideally I'd like the solution ...
0
votes
1answer
26 views

“Cannot open user default database. Login failed” after altering MDF and LDF locations and bringing DB offline

I was attempting to move my database to a separate hard drive on the server, so I ran the following commands in the following order (I was following this question : How to change location of SQL ...
0
votes
2answers
29 views

Replacing Postgres User

I'm new to postgres. It might sound a silly question, due to some security requirement I need to remove default superuser 'postgres' and replace it with any other super user (for example:abc) created ...
3
votes
3answers
116 views

Domain Admin Account Accessing SQL Server

I was monitoring some SQL calls using SQL Server Profiler and noticed a Domain Admin account accessing SQL quite a bit. We do not have a DBA at this point. There are two developers and I am one of ...
0
votes
0answers
11 views

Different security levels for one SSRS report

I am trying to grant limited access for one report per user. For example, the report consist of multiple cities and each city has profit info within them but the users should only be able to see the ...
0
votes
0answers
20 views

The security definer of my stored procedures suddenly changed on a shared hosting server

I'm on the verge of jumping down someone's throat and want to be sure I didn't somehow cause this. I am building a website on a shared server hosted by a top-three hosting company. Last night, while ...
0
votes
1answer
27 views

MySQL 8 roles - I'm probably missing something obvious

I'm trying to use roles in MySQL 8, and failing. I have read the documentation and as far as I can tell, I'm doing it right. Since this is a 'hello world' level attempt, I assume I'm missing something ...
1
vote
0answers
16 views

HQL Injection Question

This question popped into my head after reading this article. However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly: Is there ...
4
votes
5answers
603 views

Software need db owner permission to master database (sql2016)

We have a manufacturer whose software requires authorization for the master database (only db owner working). Unfortunately, the manufacturer can not tell us why this access to the master database is ...
0
votes
1answer
36 views

SQL Server : Is it necessary to disable SA user for security issues?

We have a website that will published in national grade with millions of users with Microsoft Sql Server database. I need to know is it necessary to disable SA login for security issues like DOS ...
1
vote
1answer
28 views

Prevent updating table using procedure in different database

This is my scenario: Windows User Gabe has db_owner access of database DB1. Windows User Gabe has db_reader on database DB2. When the user executes UPDATE DB2.dbo.Tbl1 SET X = 1, they get "The ...
1
vote
1answer
36 views

Disallow superusers and single-user mode in POSTGRESQL

I have a doubt about superusers and single-user mode. I want to restrict the access to a certain database, in a way that only those users which I gave privileges can see the structure of my database....
0
votes
1answer
26 views

differences in the authentication scheme - could it be because of Kerberos?

I am using this script to check the connections to my sql server: select C.client_net_address, S.host_name, c.session_id, c.net_transport, c.protocol_type, c.auth_scheme, s.program_name from sys....
1
vote
1answer
59 views

Deny Delete to An Active Directory Account in Sql Server

I want to deny an AD account to delete any record in sql server. How can i do that? DENY DELETE TO [usergorup\username] did not work. Is there another way?
0
votes
1answer
57 views

how to script server side permissions - specifically EXECUTE ON SYS.XP_PROP_OLEDB_PROVIDER?

I could not script the following server side permissions: GRANT VIEW DEFINITION ON LOGIN::[site_helpdesk] TO [Radhe] but thanks to the question below I found a solution to that: How to script out ...
1
vote
1answer
82 views

SQL Server Security - Encryption

I have requirement to store the some sensitive information in SQL Server 2016. Organization policy demands, it should be encrypted. Business Requirement: Data cannot be decrypted by DBA. Data cannot ...
0
votes
0answers
14 views

How to store Postgres password in configuration hibernate.properties

what is the correct way to provide PostgreSQL password in hibernate.properties(encrypted or plain). If encrypted, who is responsible for encryption and decryption Please post any doc which is helpful. ...
0
votes
1answer
28 views

SQL Server - Non Grantor - Alternative way to deny view list of database

We're having an instance by AWS RDS with SQL Server 2016. Lots of databases being in this instance. We need to create a login called test_user with public server role and db_datareader database role, ...
0
votes
0answers
34 views

How to access MS SQL Server databases securely without VPN

We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
4
votes
1answer
124 views

Is there any reason I shouldn't delete orphaned database users?

I've inherited a business application which has been around for c. 15 years composed of multiple databases that are all hosted on the same SQL Server (2012 SP4) instance. In all of the databases ...
3
votes
2answers
77 views

Find accounts with passwords that are not complex

I can see all the SQL Login passwords that enforce the password policy with this command SELECT * FROM sys.sql_logins WHERE is_policy_checked = 1 However, it seems that when the enforce password ...
0
votes
1answer
22 views

How to secure my data queried from my local MySQL server on a remote machine with root shared with untrusted entity?

I have a remote client machine put in a server center owned by an entity who must also have the root of the client machine according to industry regulations. The client machine runs a C++ program that ...
0
votes
1answer
53 views

SQL Server RLS vs Oracle FGAC [closed]

What is the difference between SQL Server RLS and Oracle FGAC. How to decide which one to go for? We already have both the products in place and teams to support the products.
3
votes
0answers
104 views

Can CyberArk Manage SQL Credentials To Synchronize Password Changes?

My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
1
vote
2answers
42 views

Find user who kicked off a SQL Agent job at runtime

I have inherited a breakglass procedure that allows certain users to kick off a SQL Agent job that inflates their privileges on the instance. It currently sends an email to say that it has been ...
0
votes
1answer
56 views

How to secure SQL Server in an enterprise environment?

So I've been tasked with learning how to secure our SQL Servers. Here's the scenario: Individual users have read access to a table in SQL Server. This table have apx. 33 million rows, and growing (...
1
vote
1answer
56 views

At what point is SQL Server's is_policy_checked enforced? [duplicate]

At what point is SQL Server's is_policy_checked enforced - just at next password change or at each login?
3
votes
1answer
155 views

How to grant execute permissions to a stored procedure but not to the underlying databases

I am trying to allow a user to run a stored procedure while restricting them read/write access to the underlying tables. I am able to complete this with other stored procedures, but the one I am ...
1
vote
1answer
241 views

Postgres Column Level Security

I have a schema snow within a database testdb. I'm trying to achieve column level security for my users. My users are boss, manager and intern. I set all of this table up as the superuser me. They are ...
0
votes
1answer
33 views

Run PostgreSQL without admin / superuser

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges ...
0
votes
3answers
35 views

How safe are PostgreSQL triggers against attacks?

in my PostgreSQL database I setup some triggers to prevent DELETE and EDIT operations (the triggers make sure that these operations lead to nothing). However, I'm wondering how safe these triggers are?...
2
votes
4answers
174 views

What permissions are required for UPDATE STATISTICS #table WITH ROWCOUNT = xxx?

Can anyone point me to the correct documentation or additional permissions I need besides SA to do the following? When I run it, I receive the following error: Cannot find the object "#test" because ...
0
votes
1answer
71 views

Is there a way to have a system generated report of list of DBA in SQL Server? [closed]

I'm an auditor, and I want to ask if there is a list of system generated report of DBA users in SQL Server? Per my audit client, there is no way to generate it. However, I'm thinking that this is a ...
4
votes
1answer
91 views

Execute Permissions for a Store Procedure that creates databases

I have a Stored Procedure that creates a Database for a specific project which needs to run every month by one of our Data Analysts. The question is how do I structure this to enable the Analyst to ...
1
vote
1answer
39 views

Security Risks with having Test Stored Procedures that have SQL Injection Vulnerability

I noticed that some of the stored procedures used in our integration tests for data generation have SQL injection vulnerabilities. These procedures are taking into string parameters to build a SQL ...
1
vote
0answers
25 views

Mongodb - Security weakness while using --authenticationDatabase admin? [duplicate]

I was trying to create a new Mongodb instance based on my old Mongo Database. In my current DB I have an user and password configured. So, I can access my database using: $ mongo --host $MONGO_HOST -...
0
votes
1answer
36 views

Mapping an MSSQL Login to the secondary replica in a High Availability Group

I'm trying to map a login to a user in a database on the secondary replica of a two node High Availability group. Obviously this fails since the replica is offline. Is there a way for me to create ...
1
vote
2answers
44 views

Can anything reveal that 2 independant entries were created or updated at the same time?

Imaginary example, simplified to better explain the question. Let's say I have a form with the following fields : user email who did you vote for in 2012 who did you vote for in 2016 When submitted, ...
3
votes
3answers
314 views

What's an example of an exploitation of the security from enabling Ole Automation Procedures Server Configuration option?

I have a need to enable to the Ole Automation Procedures Server Configuration Option on my SQL Server, but was wondering what specific kind of security risks do I incur by doing so? What is an ...