Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
1
vote
1answer
57 views

Quasi-Lateral Partitioning [on hold]

I have a table that stores generic data for a wide variety of purposes that are almost totally independent of one another (created by different users for example). So I'm thinking about adding an ...
0
votes
3answers
39 views

Check if a SQL Login exists without SA

How can I check if a SQL Login exists for an arbitrary domain user if the account I'm running doesn't have SA rights to the instance (but will be dbo on at least one DB) Ideally I'd like the solution ...
0
votes
1answer
18 views

“Cannot open user default database. Login failed” after altering MDF and LDF locations and bringing DB offline

I was attempting to move my database to a separate hard drive on the server, so I ran the following commands in the following order (I was following this question : How to change location of SQL ...
0
votes
2answers
25 views

Replacing Postgres User

I'm new to postgres. It might sound a silly question, due to some security requirement I need to remove default superuser 'postgres' and replace it with any other super user (for example:abc) created ...
2
votes
3answers
90 views

Domain Admin Account Accessing SQL Server

I was monitoring some SQL calls using SQL Server Profiler and noticed a Domain Admin account accessing SQL quite a bit. We do not have a DBA at this point. There are two developers and I am one of ...
0
votes
0answers
9 views

Different security levels for one SSRS report

I am trying to grant limited access for one report per user. For example, the report consist of multiple cities and each city has profit info within them but the users should only be able to see the ...
0
votes
0answers
16 views

The security definer of my stored procedures suddenly changed on a shared hosting server

I'm on the verge of jumping down someone's throat and want to be sure I didn't somehow cause this. I am building a website on a shared server hosted by a top-three hosting company. Last night, while ...
0
votes
1answer
25 views

MySQL 8 roles - I'm probably missing something obvious

I'm trying to use roles in MySQL 8, and failing. I have read the documentation and as far as I can tell, I'm doing it right. Since this is a 'hello world' level attempt, I assume I'm missing something ...
1
vote
0answers
16 views

HQL Injection Question

This question popped into my head after reading this article. However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly: Is there ...
4
votes
5answers
598 views

Software need db owner permission to master database (sql2016)

We have a manufacturer whose software requires authorization for the master database (only db owner working). Unfortunately, the manufacturer can not tell us why this access to the master database is ...
0
votes
1answer
31 views

SQL Server : Is it necessary to disable SA user for security issues?

We have a website that will published in national grade with millions of users with Microsoft Sql Server database. I need to know is it necessary to disable SA login for security issues like DOS ...
1
vote
1answer
28 views

Prevent updating table using procedure in different database

This is my scenario: Windows User Gabe has db_owner access of database DB1. Windows User Gabe has db_reader on database DB2. When the user executes UPDATE DB2.dbo.Tbl1 SET X = 1, they get "The ...
1
vote
1answer
32 views

Disallow superusers and single-user mode in POSTGRESQL

I have a doubt about superusers and single-user mode. I want to restrict the access to a certain database, in a way that only those users which I gave privileges can see the structure of my database....
0
votes
1answer
26 views

differences in the authentication scheme - could it be because of Kerberos?

I am using this script to check the connections to my sql server: select C.client_net_address, S.host_name, c.session_id, c.net_transport, c.protocol_type, c.auth_scheme, s.program_name from sys....
1
vote
1answer
57 views

Deny Delete to An Active Directory Account in Sql Server

I want to deny an AD account to delete any record in sql server. How can i do that? DENY DELETE TO [usergorup\username] did not work. Is there another way?
0
votes
1answer
48 views

how to script server side permissions - specifically EXECUTE ON SYS.XP_PROP_OLEDB_PROVIDER?

I could not script the following server side permissions: GRANT VIEW DEFINITION ON LOGIN::[site_helpdesk] TO [Radhe] but thanks to the question below I found a solution to that: How to script out ...
1
vote
0answers
71 views

SQL Server Security - Encryption

I have requirement to store the some sensitive information in SQL Server 2016. Organization policy demands, it should be encrypted. Business Requirement: Data cannot be decrypted by DBA. Data cannot ...
0
votes
0answers
14 views

How to store Postgres password in configuration hibernate.properties

what is the correct way to provide PostgreSQL password in hibernate.properties(encrypted or plain). If encrypted, who is responsible for encryption and decryption Please post any doc which is helpful. ...
0
votes
1answer
27 views

SQL Server - Non Grantor - Alternative way to deny view list of database

We're having an instance by AWS RDS with SQL Server 2016. Lots of databases being in this instance. We need to create a login called test_user with public server role and db_datareader database role, ...
0
votes
0answers
29 views

How to access MS SQL Server databases securely without VPN

We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
4
votes
1answer
124 views

Is there any reason I shouldn't delete orphaned database users?

I've inherited a business application which has been around for c. 15 years composed of multiple databases that are all hosted on the same SQL Server (2012 SP4) instance. In all of the databases ...
3
votes
2answers
63 views

Find accounts with passwords that are not complex

I can see all the SQL Login passwords that enforce the password policy with this command SELECT * FROM sys.sql_logins WHERE is_policy_checked = 1 However, it seems that when the enforce password ...
0
votes
1answer
20 views

How to secure my data queried from my local MySQL server on a remote machine with root shared with untrusted entity?

I have a remote client machine put in a server center owned by an entity who must also have the root of the client machine according to industry regulations. The client machine runs a C++ program that ...
-1
votes
1answer
44 views

SQL Server RLS vs Oracle FGAC [closed]

What is the difference between SQL Server RLS and Oracle FGAC. How to decide which one to go for? We already have both the products in place and teams to support the products.
3
votes
0answers
70 views

Can CyberArk Manage SQL Credentials To Synchronize Password Changes?

My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
1
vote
2answers
40 views

Find user who kicked off a SQL Agent job at runtime

I have inherited a breakglass procedure that allows certain users to kick off a SQL Agent job that inflates their privileges on the instance. It currently sends an email to say that it has been ...
1
vote
0answers
52 views

ADD SENSITIVITY CLASSIFICATION on Azure SQL DB fails

I have received "A Vulnerability Assessment scan" email from Microsoft, where it claims I'm missing this line: ADD SENSITIVITY CLASSIFICATION TO [dbo].[Mytable].[creditor_amount] WITH (LABEL = '...
0
votes
1answer
54 views

How to secure SQL Server in an enterprise environment?

So I've been tasked with learning how to secure our SQL Servers. Here's the scenario: Individual users have read access to a table in SQL Server. This table have apx. 33 million rows, and growing (...
1
vote
1answer
35 views

At what point is SQL Server's is_policy_checked enforced? [duplicate]

At what point is SQL Server's is_policy_checked enforced - just at next password change or at each login?
3
votes
1answer
115 views

How to grant execute permissions to a stored procedure but not to the underlying databases

I am trying to allow a user to run a stored procedure while restricting them read/write access to the underlying tables. I am able to complete this with other stored procedures, but the one I am ...
1
vote
1answer
103 views

Postgres Column Level Security

I have a schema snow within a database testdb. I'm trying to achieve column level security for my users. My users are boss, manager and intern. I set all of this table up as the superuser me. They are ...
0
votes
1answer
33 views

Run PostgreSQL without admin / superuser

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges ...
0
votes
3answers
34 views

How safe are PostgreSQL triggers against attacks?

in my PostgreSQL database I setup some triggers to prevent DELETE and EDIT operations (the triggers make sure that these operations lead to nothing). However, I'm wondering how safe these triggers are?...
2
votes
4answers
108 views

What permissions are required for UPDATE STATISTICS #table WITH ROWCOUNT = xxx?

Can anyone point me to the correct documentation or additional permissions I need besides SA to do the following? When I run it, I receive the following error: Cannot find the object "#test" because ...
0
votes
1answer
68 views

Is there a way to have a system generated report of list of DBA in SQL Server? [closed]

I'm an auditor, and I want to ask if there is a list of system generated report of DBA users in SQL Server? Per my audit client, there is no way to generate it. However, I'm thinking that this is a ...
4
votes
1answer
85 views

Execute Permissions for a Store Procedure that creates databases

I have a Stored Procedure that creates a Database for a specific project which needs to run every month by one of our Data Analysts. The question is how do I structure this to enable the Analyst to ...
1
vote
1answer
35 views

Security Risks with having Test Stored Procedures that have SQL Injection Vulnerability

I noticed that some of the stored procedures used in our integration tests for data generation have SQL injection vulnerabilities. These procedures are taking into string parameters to build a SQL ...
1
vote
0answers
22 views

Mongodb - Security weakness while using --authenticationDatabase admin? [duplicate]

I was trying to create a new Mongodb instance based on my old Mongo Database. In my current DB I have an user and password configured. So, I can access my database using: $ mongo --host $MONGO_HOST -...
0
votes
1answer
30 views

Mapping an MSSQL Login to the secondary replica in a High Availability Group

I'm trying to map a login to a user in a database on the secondary replica of a two node High Availability group. Obviously this fails since the replica is offline. Is there a way for me to create ...
1
vote
2answers
42 views

Can anything reveal that 2 independant entries were created or updated at the same time?

Imaginary example, simplified to better explain the question. Let's say I have a form with the following fields : user email who did you vote for in 2012 who did you vote for in 2016 When submitted, ...
3
votes
3answers
190 views

What's an example of an exploitation of the security from enabling Ole Automation Procedures Server Configuration option?

I have a need to enable to the Ole Automation Procedures Server Configuration Option on my SQL Server, but was wondering what specific kind of security risks do I incur by doing so? What is an ...
10
votes
2answers
873 views

Locked my sa user out

So I was trying to change some settings in my Microsoft SQL Server Management Studio 2019. I change the login mode from mixed (Windows and SQL authentication) to only Windows and now I am not able to ...
4
votes
1answer
76 views

SQL Server impersonation

This question is about impersonation in Microsoft SQL Server. I want to know that if I have impersonation permissions on a specific login then I can easily impersonate that login whenever I want and I ...
8
votes
1answer
157 views

Dropping the automatically created NT AUTHORITY and NT SERVICE accounts

So I recently moved jobs - one piece of code I've spotted in our build scripts for new SQL Server installations is below. IF EXISTS ( SELECT * FROM [sys].[syslogins] WHERE ...
2
votes
2answers
53 views

If database is compromised and downloaded, does it matter if user passwords are hashed?

I'm currently implementing as much security into a web app as possible, but I can't stop thinking about the database itself. For all the security I implement, such as salting and hashing passwords in ...
2
votes
0answers
38 views

How do I prevent PostgresQL users/roles from having access to any administrator functions?

When I create a user with CREATE ROLE user123 LOGIN on my system it is able to login and immediately perform \du and interact with pg_stat_activity, and probably many other things. I have ...
1
vote
1answer
30 views

Temporary role/privileges

Is it possible in PostgreSQL to temporary grant roles/privileges to a user? I'm thinking about this as a solution for the situation when there is a need to troubleshoot an issue and an user may need ...
0
votes
1answer
112 views

Finding all users with access to a table in SQL server

Wondering if there is any script out there to extract a list of all database logins with access to a particular table, whether its given thru a view, database role, etc.
0
votes
0answers
17 views

Windows Application MySQL Error Log Activity

I have a MySQL DB that has a publicly exposed port w/ limited IPs. I started getting errors in my Windows Application Error Log with Source=MySql and EventId=100. They are all some form of IP ...
2
votes
1answer
70 views

Dangerous MySQL functions

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...