Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Why does the EnterpriseDB installer for PostgreSQL on Windows and Mac default to "listening to all"?

PostgreSQL is a free and open source database software. For various reasons which I don't understand, they have "outsourced" the Windows and Mac installers onto a company called "...
user291937's user avatar
0 votes
1 answer
49 views

What is the difference between a securable and permission in SQL Server?

In Microsoft SQL Server you have the possibility to set permissions at server and database level. You are also able to select a server login or database user and then set securables. I am wondering ...
Jacob Gomez Hansen's user avatar
4 votes
5 answers
2k views

SQL Server with multiple databases (one per client) - what is the best security practice in terms of logins/users/permissions?

We have multiple SQL Servers with each holding dozens of databases - one per client (a client in this case means a customer organization). These databases are accessed via an application, but the ...
SQL_Guy's user avatar
  • 635
-1 votes
2 answers
37 views

Making a database publicly readable to anyone on the Internet [closed]

Say that I have some data that is publicly available to begin (like an archive of hackernews stories), and I would like to make it available publicly in a sql database that is world-accessible. The ...
pseudosudo's user avatar
1 vote
1 answer
93 views

Can I revoke database permissions on "NT AUTHORITY\SYSTEM" but still let it have the "sysadmin" role?

I need to implement this: https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2020-12-16/finding/V-213934 In our instance IsClustered and IsHadrEnabled are both 0. Using an automated tool it ...
The ITea Guy's user avatar
9 votes
6 answers
3k views

Is this SQL Procedure "injection proof"?

Most all answers and examples of SQL injection are showing some form of dynamic SQL or interpreting parameters as SQL. I haven't been able to find an example of the "correct" way. Microsoft ...
UpTide's user avatar
  • 261
0 votes
0 answers
15 views

Backup SQL Server on a shared folder from Azure DevOps / Command line [duplicate]

I need to back up my database using a command line instruction. I launch the backup instruction from a Azure DevOps Release Pipeline to back up my SQL server database on a share folder on another ...
Bastien Vandamme's user avatar
0 votes
1 answer
59 views

Is there a way for mongodb clients to connect to mongodb server (SSL/TLS enabled) without client certificates?

I am trying to setup a MongoDB with SSL/TLS enabled. I'm just wondering is there a way for clients to connect to my mongodb server without having a client certificate that would not compromise the ...
JRA's user avatar
  • 109
1 vote
0 answers
53 views

How to enable Database Auditing on SQL server

I want to audit SQL database activities, but when I am trying to enable Database Level Adut specification, it is capturing all activities that is done from application side and also from queries that ...
Gizaw Simeon's user avatar
5 votes
2 answers
126 views

Is it secure to have database login in a PHP file? Other options?

I'm a DB and SQL beginner. I'm putting together a basic PHP app that has a few SQL queries. In all my searching and learning, every example accessed the database by first logging in. Makes sense, but ...
user1934286's user avatar
0 votes
1 answer
60 views

Why is to_char used when doing a divide by 0 in Oracle based SQLi?

For conditional-error-based SQLi, instead of writing 1/0 directly like MYSQL, we need to write to_char(1/0) for Oracle, what is the reason behind this? Example, Oracle: SELECT CASE WHEN (YOUR-...
Vbr's user avatar
  • 1
1 vote
2 answers
132 views

Revoke select on sys.database_principals

Following a request from the Security Team, do you think is there any issue if I revoke access to these tables? Use Master GO REVOKE SELECT ON sys.database_principals TO PUBLIC; REVOKE SELECT ON sys....
MBuschi's user avatar
  • 4,045
0 votes
0 answers
123 views

Revoke execute on some xp procedures

Following a request from the Security Team, There is any issue if I revoke access to these sp to PUBLIC. Any suggestion? REVOKE EXECUTE ON xp_fileexist TO PUBLIC REVOKE EXECUTE ON xp_getnetname TO ...
MBuschi's user avatar
  • 4,045
3 votes
1 answer
115 views

SQL Server data confidentiality in case of intrusion of machine host

I have to premit that i am a programmer, and i am trying to learn a bit about DBA even if i don't have the same background. I am trying to understand what security provide, and how to use, encryption ...
Skary's user avatar
  • 351
0 votes
1 answer
199 views

using encrypted password in xp_cmdshell command

Dears , i am trying to make the mapped drive visible to SQL server and as a security requirement, I need to use user name and encrypted password because this will be saved on the logs if it is plain ...
Tala 's user avatar
  • 31
0 votes
1 answer
43 views

How does MySQL maintain confidentiality of files?

In a DBMS like MySQL, are the underlying files that contain the data encrypted since we want to have role and user based control? If they are encrypted, what encryption keys and algorithms are used? ...
Tabish Mir's user avatar
1 vote
0 answers
20 views

Is this the best practice for separating all records by user company?

This is more of a general database question than specifically a Prisma question, but the implementation I have is written using Prisma connected to MySQL. Take the following part of my schema.prisma: ...
Basil's user avatar
  • 111
0 votes
0 answers
25 views

remove unix user named postgres after complete uninstallation of postgresql

I'm running MX Linux 21 and recently installed PostgreSQL-13; I wanted postgres to have read, write and execute access to a certain folder therefore I added the unix user postgres to the group of ...
stucash's user avatar
  • 101
2 votes
1 answer
224 views

How to enable authentication logs in Firebird 2.5?

I downloaded Firebird 2.5 from the official website and installed on a Linux machine. The install location is /opt/firebird. I want to be able to view authentication attempt logs for security reasons (...
Lucas Miranda's user avatar
0 votes
1 answer
33 views

How to list the permissions needed for a role / user to run a query / view successfully (in an automated manner)?

Suppose I have queries / views like this: select internal.companies._cid, internal.companies.name, src1.employees.year, src1.employees.count from internal.companies join src1....
m01010011's user avatar
  • 101
0 votes
0 answers
53 views

MSSQL Server Database Trigger Permissions - issue after migrating from 2008 to 2017 Server

I have some triggers set up on a database (Dynamics NAV) across various tables for Insert, Update, Delete. The triggers write to a separate database to log the DB, Table, RowId and date/time. The ...
David Mapes's user avatar
0 votes
1 answer
94 views

Cannot run nodetool commands after enabling JMX authentication in DSE

I would like to use these two pages to enable DSE Unified Authentication and realize a secure environment. I have tried to configure it but it does not work. How is it as a symptom. When I type ...
Youjie's user avatar
  • 31
2 votes
1 answer
382 views

The Trustworthy option should be disabled but what is an alternative?

I run vulnerability assessment report in SQL Server 2016 and I received this issue VA1102 The Trustworthy bit should be disabled on all databases except MSDB The reason of setting Trustworthy to ...
Muflix's user avatar
  • 1,039
0 votes
1 answer
37 views

What does the term "server" mean in this context?

I am currently familiarizing myself with SQL Server security. During the process, I came across the following text passage. Windows-level principals are generally domain and local server user ...
launcher's user avatar
0 votes
2 answers
59 views

What's the best way of going about storing information from different groups of users?

In my application, users (and all data) is grouped by company. So, for example, every customer in the database has a company assigned to it, as does every product etc. The user can log in with their ...
Basil's user avatar
  • 111
0 votes
0 answers
30 views

Postgres - basic security settings

I'm setting up a PostgreSQL instance for some logging data (non-critical). It will be accessible from internet. It's hosted on an azure VM. I'm wondering what would be a decent setup to have basic ...
user49126's user avatar
  • 103
0 votes
1 answer
38 views

SQL security clarification

With SQL server, do default roles 'trump' defined securables and/or custom roles? I am cleaning up security on my servers, and I have accounts that have datareader membership to the database, ...
Paul McKibben's user avatar
3 votes
2 answers
498 views

What ports to open for sql server behind secure domain firewall

We are trying to solve connectivity issues for one of the app trying to pull data from very secured sql server behind firewall. I am not that expertise in security but need help on how to proceed in ...
Newbie-DBA's user avatar
0 votes
0 answers
75 views

When rebuilding sql server on a new machine, should SMK be restored prior to or after restoring system dbs?

Service Master key is at top of sql server encryption hierarchy. Linked server, credentials, database master key (if any) are encrypted using the service master key. When rebuilding a sql server using ...
variable's user avatar
  • 3,205
0 votes
0 answers
175 views

Where is the service master key (SMK) and database master key stored?

Sql server encryption has got the service master key at the top of the hierarchy. The database master key is encrypted with the service master key. The database master key is stored in the respective ...
variable's user avatar
  • 3,205
0 votes
0 answers
94 views

Mariadb equivalent to MySQL CONNECTION_CONTROL

MySQL introduced a security plugin library in version 5.7.17 including the plugin CONNECTION_CONTROL, which checks incoming connection attempts and adds a delay to server responses as a result of ...
Jon Godden's user avatar
0 votes
1 answer
64 views

Is safe to allow Database accessible from internet

We have a database that many clients need to read/write via internet. There are two methods to deploy: (A) [Database server] <---internet/SSL---> [Clients]: Allow database can be directly ...
TrungNT's user avatar
0 votes
1 answer
45 views

How to switch session user using trusted context in db2cmd?

I would like to connect to Db2 database with user "appuser1" and then switching session user to "user1". In Db2 v11.5.7 on Linux I connected to server using SSH. I connected to ...
folow's user avatar
  • 183
-1 votes
1 answer
52 views

How secure is a local harddrive stored database?

I am currently creating a database that contains sensitive data such client names, addresses, etc. I have never worked with the setting up of servers but my research tells me to either use a cloud ...
pursuitOf's user avatar
0 votes
0 answers
75 views

How to find statement causing "The user does not have permission to perform this action." in Azure SQL Database?

I ran a Kusto query: AzureDiagnostics | where TimeGenerated > ago(1d) | where Category == "Errors" and error_number_d == 297 | summarize count(), min(TimeGenerated), max(TimeGenerated) ...
Mark Freeman's user avatar
  • 2,140
1 vote
1 answer
612 views

[ SQL Error 15173 ]Unable to drop a SQL Server Login (Login is a AD Group)

Recently I have added a SQL Server Login and later want to drop it. But I am seeing below issue, can you please see what is my miss here. USE [master] GO /****** Object: Login [] Script Date: 5-6-...
Learning_Learning's user avatar
0 votes
0 answers
70 views

postgresql is my approach to row-based access control not simpler and more efficient under my stated assumptions?

When you have a 3 tier system with an application server in the middle, using a single database connection user but managing application users differently as it is typically done, how do you implement ...
Gunther Schadow's user avatar
3 votes
1 answer
110 views

Is an SSL Certificate Authority Chain "Secret"

We've recently signed up to use MariaDB's SkySQL package, however are new to the use of SSL Certificate Chains when connecting (having only really used SSH tunnels in the past). We have the key which ...
IQJWSB0DLT's user avatar
0 votes
1 answer
677 views

Restrict access to a new schema to a specific role despite users having db_datareader?

I'm working in a SQL Server 2016 database that is not of my design nor can I fundamentally change the security structure. I know it is likely trash/worst practice but I have to play the hand I am ...
Crescent's user avatar
15 votes
5 answers
4k views

Can ransomware embed itself in to a SQL backup file?

One of the best protections against ransomware is to back up all of your database files to a completely separate system. Which we have done. But one thought is the backup of the database could ...
icecurtain's user avatar
1 vote
0 answers
27 views

How to set administrative user in Mysql 5.7

I am trying to run a scan from Nessus against Mysql 5.7 database I am getting the following error: Ensure Only Administrative Users Have Full Database Access 'mysql.user' Perform the following actions ...
James Connigan's user avatar
1 vote
1 answer
185 views

Is it secure to store connection password on Pentaho Spoon?

I'm gonna use Spoon to transfer data from Postgres to MSSQL. I see that when we create connection its data is stored and we don't need to type password anymore. But I can't find where it stores this ...
Hikari's user avatar
  • 1,493
2 votes
1 answer
434 views

Password storage best practices

We have a system (.NET application + sql server) where in addition to regular user passwords we need to store passwords that are used by the application processes to access various other subsystems or ...
ArtW's user avatar
  • 21
0 votes
2 answers
78 views

Column data masking security problem

In Db2 v11.5.7 on Linux I have simple table: create table admin.patient_data ( patientid int not null primary key, patient_name varchar(10), illness varchar(15), doctor_name varchar(10) ); insert ...
folow's user avatar
  • 183
0 votes
1 answer
88 views

Increase security of mongodb-based flask/react applications?

this is the first time I use mongodb seriously, and I have a question about best practices when it comes to access. Say you have a typical mongodb/flask application. The users use the browser (via ...
Stefano Borini's user avatar
0 votes
2 answers
830 views

db2 - how to get list of all of the Db2 instances on computer

I have several Linux servers and on them may be one or more Db2 instances. Db2 instances can be from different Db2 versions. For security audit I need to write some simple bash script to check for ...
folow's user avatar
  • 183
0 votes
1 answer
349 views

IIS web application access SQL DB as service account

I've setup a new Python site on iis using FastCGI handler. The site has windows authentication enabled in iis and the app checks that the AD user belongs to an active directory group when they access ...
DeadlyDan's user avatar
  • 101
0 votes
0 answers
58 views

Is there a readymade script that I can use to automate sync of server level logins, roles and securable permissions between 2 SQL servers?

I have configured log shipping from SQL1 to SQL2. Database level users, roles and securable permissions are getting transferred. However suppose the user doesn't exist on the server level login, then ...
variable's user avatar
  • 3,205
1 vote
1 answer
609 views

MySQL server accessible from the internet nmap scan result

I have a MySQL database on a server which is accessible from the internet and I'm doing some security checks. A nmap script scan shows the information below. I'm curious if an attacker can derive ...
user avatar
2 votes
0 answers
203 views

How to create logins in sql server based on the Azure Active Directory?

In my Azure environment I have many resources, and I have a virtual machine that contains my sql server database This is my virtual machine: What I would like to achieve is to create logins inside my ...
Marcello Miorelli's user avatar

1
2 3 4 5
22