Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
-1
votes
1answer
22 views

what would be the best way to store password hashes with regards to k-anonymity?

do i need to do anything special or can i just store them in a single field table? i feel like i'm missing some security concerns if i just store the sha-1 hashes in a db with a single field table. ...
0
votes
0answers
20 views

Why I cannot do this in SSMS directly? (assigning a LOGIN to a USER)

In SQL Server 2008 R2, I want to change the LOGIN for a USER in a database. FROM THIS: TO THIS: Initially, the database has the [...] dots option to change this greyed-out (why?): The only way to ...
1
vote
2answers
58 views

How to grant permissions to allow anything inside a SQL Server schema?

I have a schema called training. I have a new role called training_modify. Here are the desired permissions for users placed in that role: Select, update, insert, and delete permissions on any object ...
0
votes
0answers
11 views

gMSA for running a sql agent job

I've had the question if it's possible to add a gMSA-account to the SQL-logins in order to let it perform a certain SQL Agent Job. I know it's possible to add a gMSA as a login but it will probably ...
1
vote
1answer
31 views

SQL Server Grant CRUD to Users on One Schema

I have a schema called training. I want users who will be trained to have CRUD permissions on any object on that schema. I do not want them to have any other permissions on any other object outside ...
9
votes
2answers
555 views

Break the link between a Database User and SQL Server Login

When restoring database from once instance to another one sometimes has to relink SQL Server Logins to the Database User. This is normally achieved with one of the following procedures. Deprecated ...
0
votes
1answer
51 views

Determine the source of user permissions in a database

I have a developer that just accidentally ran an UPDATE and ALTER TABLE script he was working on in a production database instead of the development environment. How can I track down what security ...
0
votes
1answer
24 views

Cassandra security - private IPs with some VPN solution or public IPs and open ports?

there are many different solutions to secure a cassandra cluster. One of them is to enter public IPs and open the 7000/9042 port on each sever. Another one is to have everything in a private network ...
1
vote
1answer
31 views

Allows to select on view, while hiding its definition

I need to create a user in PostgreSQL with the least privileges possible. So, the user would only be allowed to do queries on specific tables and views. That user should not be allowed to get any ...
0
votes
2answers
34 views

SQL Server 2016 Express, need to add account with Administrator access to a database

Working with a new SQL Server 2016 Express installation. I loaded SSMS and have Administrator access to the instance. The vendor supplied a database for a new app that has only a couple internal ...
8
votes
1answer
294 views

Security implications of enabling CLR on shared instance

My database is currently isolated in its own instance and VM. My customer is retiring that server and I need to migrate the DB to a new environment. My DB uses CLR, so the new environment needs to ...
0
votes
1answer
17 views

Granting access to users to run specific SQL jobs that runs SSIS packages [duplicate]

We need to grant a couple of users access to run only specific SQL jobs that runs SSIS packages. Is there a solution that can be used to accomplish this?
0
votes
1answer
33 views

Restrict server login by user AND machine (within or not within a domain): is it possible?

I'm trying to setup a SQL Server 2008 R2 instance, restricting access to my database so only specific users on specific machines can login there. Let's say, we have 3 devs: John, Jill and Steve, with ...
0
votes
1answer
15 views

Recreate a Certifcate Encrypted by Password to another database

I have created a stored procedure which requires permissions across a number of databases: USE MyDB; CREATE PROCEDURE dbo.MyProc ( @ScheduleName NVARCHAR(260), @KeepSchedule BIT = 0 ) AS ...
0
votes
1answer
31 views

Sqlserver 2019 Partitioning based on Data Classification? [duplicate]

Now that sqlserver 2019 has been around for a while, this is a re-ask of a prior question that was not really answered in the way I had hoped: Is it possible to partition a database based on the ...
1
vote
1answer
31 views

Should a local account be set up and used solely to install SQL Server?

I'd like to follow best practices. However, is it overkill to create a new local user account (with minimal access and no special rights) and then use that account to install SQL Server? Are there ...
0
votes
1answer
39 views

Should every job, SSIS project, SSRS have its own sql login

Apologies for asking an opinion type question, but I'd like to know what is best practice. I have a bunch of sql servers and every job as well as every connection manager for every SSRS report & ...
1
vote
1answer
29 views

how to script out proxy accounts?

I have servers where I use proxy accounts to run ETL processes or even to backup SSAS databases using powershell through a job. I can see what AD Accounts are related to my proxies: use msdb go ...
0
votes
1answer
16 views

Configuration file missing after successful SSRS migration

Getting the backup of all SSRS databases including compressing and encrypting can be straight forward. However, when planning a complete solution for SQL Server Reporting services backup, following ...
0
votes
1answer
56 views

MS SQL - CLR Stored Procedure runs as deleted user

I have a SQL Server 2017 database which contains some CLR stored procedures. When trying to call those CLR SP's, I get a "login failed" error back from the CLR SP. My user is connected and works ...
1
vote
0answers
54 views

How to hide SQL Server connection string and SQL login password from Developers

We are using Microsoft Azure App Services to host some of our Web Apps. Web Apps connect to on-premises SQL Server over hybrid connections. When new Web App needs access to the on-prem SQL Server, a ...
0
votes
1answer
20 views

Split database for security and privacy reasons

Currently I have a small business where I have a main product (written in PHP and MySql), several users, several companies, etc. The software occupies around 20 tables in its operation. The problem ...
0
votes
1answer
29 views

Postgres security for functions with “security definer”

I was reading about possible security issues when creating functions in Postgres with "security definer". Official documentation suggests that search_path is set to some trusted schema followed by ...
0
votes
0answers
23 views

How to remove Sql Server Fingerprints? [duplicate]

I have a sql server which being monitor by Nagios. One day, i received some alerts from nagios come with some sensitive information like: Critical Alert: dbi connect (Server name: ABC, Encrypted ...
1
vote
1answer
67 views

Changing the login name for user dbo

I have a database where the owner is Login1 but the username dbo is assigned to Login - login2. I understand in order to change the login name for the username dbo to sa I will have to use the below ...
1
vote
1answer
61 views

How to Hide Sql Server Fingerprint?

I have a sql server which being monitor by Nagios through snmp string. One day, i received some alert from nagios come with some sensitive information like: Critical Alert: dbi connect (Server name: ...
0
votes
0answers
17 views

Does SSRS report user needs database level permission?

I have a separate reporting server and a separate database server. Now on the Reporting server site settings I could see there are some roles and users. Suppose a User BOB has ‘POWER USER’ role ...
1
vote
1answer
66 views

openssl s_client does not indicate that SQL Server is using TLS, however the connection is secure. How is that possible?

I am connecting to SQL Server 2017 using ODBC and MSSMS. The connection is not using TLS; I checked it using openssl s_client. However, the DBA assures me that the connection is secure. What ...
0
votes
1answer
29 views

Specifying MySQL user hosts with IPv6 addresses

Inspired after making the move to IPv6 on my MySQL server, and intrigued by the lack of documentation regarding 'user'@'[IPv6]' nomenclature I proceeded to discover how to limit my users based on ...
0
votes
1answer
18 views

Defining password complexity and its action on “grace” state USERS

I have Oracle USERS linked to external applications that came to "grace" status. I tried to change the assword time expiration to unlimited but it doesn't apply to those account (considering I guess ...
1
vote
2answers
38 views

WHERE clause not preventing return of row but changing values for aggregate function (here: count)

I have recently discovered a PostgreSQL behavior which is strange and problematic in my opinion. Consider this simple query SELECT 'something confidential' WHERE FALSE; The nonsense clause ...
0
votes
1answer
53 views

sp_configure set at code execution - Pro/con's of turning on/off

The right answer of course is 'it depends', but on the surface it seems to make sense to turn on/off some options when needed as the code sample below for Ole Automation Procedures would do. Could ...
0
votes
1answer
43 views

How to implement UNIX like ACL for table rows

EDIT: I can't create or use native MySQL users. I have to use users stored in table with their password hash. I am new sql stuff so please forgive me for asking dumb question. I am creating my first ...
1
vote
1answer
61 views

Discover who changed SQL Server service state

There's any way to find out who stopped\restarted\started the following services ? SQL Server Database Engine SQL Server Agent SQL Server Analysis Services Thanks !
0
votes
2answers
54 views

pre login initialization =29237; handshake=26244

Connecting to one of my servers (no mirror or availability group running), from a local machine and I get this error message below related to handshake when the firewall is up. when the firewall is ...
3
votes
1answer
250 views

How to grant permission to execute stored procedure in master database from another database

Our developers have a domain account used by their application that needs to be able to execute stored procedures created in the master database using the "sp_" naming convention from other databases ...
0
votes
0answers
50 views

If there is no end-user input, is it safe to un-parameterize a parameterized query to avoid parameter sniffing?

AFAIK, a parameterized query is commonly used to prevent SQL injection attacks. What if there is no end-user input that can cause SQL injection? In this case, is it safe to un-parameterize a ...
1
vote
1answer
87 views

SQL Injection penn testing from the queries only

Is there an established method or tool available to perform pen testing on an application by only testing queries it sends to the database? For example, if I have a bunch of SQL Servers hosting ...
2
votes
1answer
426 views

How to force a sysadmin to store data in schema other than dbo? [duplicate]

I am using a GUI tool to upload data in my SQL Server 2016 database. The user being used for above task has been granted sysadmin permission I created a dedicated schema to store above data. This ...
0
votes
1answer
130 views

Sql server/azure connection string parameter for readonly access?

Is there a specific parameter that can be used in a SQL server/azure connection string to specify that the connection should be readonly? In other words, only SELECT queries should work but INSERT/...
0
votes
1answer
92 views

Secure postgres 9.5 database packed on Windows desktop application

My desktop app includes a postgres database and a front app. I need the db to be accessed only by my front app. The credentials of this user are going to reside in the front app binaries. I realized ...
0
votes
1answer
87 views

Need help in leveraging MySQL auditing

We are setting up password rotation policy to rotate account/password quarterly. We are also planning to use MySQL/Maria/Percona Auditing. Need to figure out the most efficient and feasible way to ...
3
votes
1answer
154 views

Allowing non-privileged users to cause privileged code to run

Context: Our SQL server is used for teaching, and we need to be able to automatically create databases for the students on demand and in real-time. We also need the students to be able to delete ...
-1
votes
1answer
105 views

Need to understand the security flaw?

I am creating a database of encrypted value. Let us say I store "John" which would be encrypted and stored as "Yoky". John | Yoky Now I store "Johnny" which would be encrypted and store as "Koaddy" ...
0
votes
1answer
99 views

Firewall security and SQL Server

I have been receiving messages in my log file saying :- "Login failed for user 'sa': Reason Password did not match that for the login provided. [Client:xx.xx.xx.xx]" the xx are actual numbers. In ...
4
votes
1answer
460 views

Can SET IDENTITY_INSERT be allowed with less privileges than db_ddladmin?

I've inherited a system where the application is running under sysadmin account. I limited this account to db_datareader + db_datawriter + EXECUTE on all database and set extended events session to ...
-3
votes
3answers
150 views

Hide business data from maintenance user

I'm newbie in postgres and have a question: we have some clients that have ultra-super-secure-sensitive data on postgres and they don't want to show it anyone. but sometime, the apps experience some ...
0
votes
1answer
158 views

MySQL least privileges to get database/tables size

I'm using centreon_plugins to monitor some mysql databases. As a best practice I create a dedicated user for monitoring and I give it the least possible privileges. For simple monitoring I usually ...
4
votes
2answers
575 views

SQL Server trusted connection additional security

Using Windows authentication, is there a way to prohibit users from connecting via ODBC to the database?
0
votes
1answer
109 views

Create a user on database A with a procedure from database B (with EXECUTE AS)

I have 2 logins : LoginA: role dbcreator + CONNECT ANY DATABASE LoginB: role sysadmin I have 2 databases : dbA: everyone has all rights on it dbB: only LoginB has rights on it, LoginA is only the ...

1
2 3 4 5
20