Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

If there is no end-user input, is it safe to un-parameterize a parameterized query to avoid parameter sniffing?

AFAIK, a parameterized query is commonly used to prevent SQL injection attacks. What if there is no end-user input that can cause SQL injection? In this case, is it safe to un-parameterize a ...
1
vote
1answer
63 views

SQL Injection penn testing from the queries only

Is there an established method or tool available to perform pen testing on an application by only testing queries it sends to the database? For example, if I have a bunch of SQL Servers hosting ...
-1
votes
0answers
46 views

Database specific/Only user?

I am working on a App which will have multiple users. So I can't use SQL API such as Qt SQL Directly from my app cause for security reasons. So I am thinking to use some HTTP REST API wrapper around ...
2
votes
1answer
396 views

How to force a sysadmin to store data in schema other than dbo? [duplicate]

I am using a GUI tool to upload data in my SQL Server 2016 database. The user being used for above task has been granted sysadmin permission I created a dedicated schema to store above data. This ...
0
votes
1answer
61 views

Sql server/azure connection string parameter for readonly access?

Is there a specific parameter that can be used in a SQL server/azure connection string to specify that the connection should be readonly? In other words, only SELECT queries should work but INSERT/...
0
votes
1answer
60 views

Secure postgres 9.5 database packed on Windows desktop application

My desktop app includes a postgres database and a front app. I need the db to be accessed only by my front app. The credentials of this user are going to reside in the front app binaries. I realized ...
0
votes
1answer
62 views

Need help in leveraging MySQL auditing

We are setting up password rotation policy to rotate account/password quarterly. We are also planning to use MySQL/Maria/Percona Auditing. Need to figure out the most efficient and feasible way to ...
3
votes
1answer
121 views

Allowing non-privileged users to cause privileged code to run

Context: Our SQL server is used for teaching, and we need to be able to automatically create databases for the students on demand and in real-time. We also need the students to be able to delete ...
-1
votes
1answer
83 views

Need to understand the security flaw?

I am creating a database of encrypted value. Let us say I store "John" which would be encrypted and stored as "Yoky". John | Yoky Now I store "Johnny" which would be encrypted and store as "Koaddy" ...
0
votes
1answer
72 views

Firewall security and SQL Server

I have been receiving messages in my log file saying :- "Login failed for user 'sa': Reason Password did not match that for the login provided. [Client:xx.xx.xx.xx]" the xx are actual numbers. In ...
4
votes
1answer
253 views

Can SET IDENTITY_INSERT be allowed with less privileges than db_ddladmin?

I've inherited a system where the application is running under sysadmin account. I limited this account to db_datareader + db_datawriter + EXECUTE on all database and set extended events session to ...
-3
votes
3answers
124 views

Hide business data from maintenance user

I'm newbie in postgres and have a question: we have some clients that have ultra-super-secure-sensitive data on postgres and they don't want to show it anyone. but sometime, the apps experience some ...
0
votes
1answer
86 views

MySQL least privileges to get database/tables size

I'm using centreon_plugins to monitor some mysql databases. As a best practice I create a dedicated user for monitoring and I give it the least possible privileges. For simple monitoring I usually ...
0
votes
1answer
89 views

Create a user on database A with a procedure from database B (with EXECUTE AS)

I have 2 logins : LoginA: role dbcreator + CONNECT ANY DATABASE LoginB: role sysadmin I have 2 databases : dbA: everyone has all rights on it dbB: only LoginB has rights on it, LoginA is only the ...
0
votes
1answer
76 views

Cross Database with Application Role

I have a requirement to access (read) a table/view in database B from database A. The application that needs to execute the query however uses an Application Role. From what I've read and tried, doing ...
1
vote
0answers
83 views

MySQL Password Validation - No previous passwords

I wonder if there is any possibility to use the password validation for MySQL 5.6 (https://dev.mysql.com/doc/refman/5.6/en/validate-password.html) to prevent for example the last 4 passwords. The ...
3
votes
1answer
138 views

Never changing the password for distributor_admin for local instance only?

Per Does distributor_admin need sysadmin? distributor_admin needs SA and per Can the account name of 'distributor_admin' be changed? the name can not be changed. The password is changed with ...
3
votes
1answer
166 views

How do I grant a SELECT permission to an individual user who's part of a large group that is explicitly denied?

I have a table SuperSecretData which is currently setup to deny SELECT to everyone in the company by the standard Active Directory account "Domain Users". But a couple of specific individual users do ...
0
votes
1answer
79 views

Grant User permission to view XE results via sys.fn_xe_file_target_read_file

I need to grant a user (MyDomain\JohnSmith) permission to view one particular XE session results using sys.fn_xe_file_target_read_file I thought the best way to do this would be to encapsulate the ...
0
votes
1answer
164 views

SA account locked out then unlocked somehow

This morning I noticed that our sa sql server account was locked out, and then somehow unlocked. 9/27/2019 5:28:26 AM - Login failed for user 'sa'. Reason: Password did not match that for the login ...
-1
votes
1answer
136 views

Data sensitivity classification in SQL Server 2019

Is there any way in SQL Server 2019 to physically partition data by Data Sensitivity Classification and thereby allow different security mechanisms to be used with different sensitivities? New ...
0
votes
1answer
148 views

I am trying to connect My R studio to SQL Database on the Remote Desktop

The SQL Server on the remote desktop is configured to have neither login nor password, it is configured to use Windows Authentication. Code I am using the following code to connect: library(DBI) ...
0
votes
1answer
106 views

Cascading REVOKE not working in MYSQL

I've read about an SQL option of cascading permissions when issuing a REVOKE statement. I've googled for how this option is implemented in MySQL, but haven't found it at all. This is the docs page ...
0
votes
2answers
109 views

SQL Server 2016: Granting security to do everything but read / write data

We have an offshore support team coming online to support our servers as DBAs for 24x7 support. However, there are several instances that have a limitation due to contracts that limit offshore access ...
1
vote
1answer
76 views

SQL Connector for Azure Key Vault - Cannot use more than one key vault

I am using SQL Server 2016 Enterprise Edition with SQL Connector for Azure Key Vault. I am trying to attach more than one Key Vault to my SQL instance but it is not working. I went through these ...
0
votes
3answers
188 views

Check if a SQL Login exists without SA

How can I check if a SQL Login exists for an arbitrary domain user if the account I'm running doesn't have SA rights to the instance (but will be dbo on at least one DB) Ideally I'd like the solution ...
0
votes
1answer
81 views

“Cannot open user default database. Login failed” after altering MDF and LDF locations and bringing DB offline

I was attempting to move my database to a separate hard drive on the server, so I ran the following commands in the following order (I was following this question : How to change location of SQL ...
0
votes
2answers
79 views

Replacing Postgres User

I'm new to postgres. It might sound a silly question, due to some security requirement I need to remove default superuser 'postgres' and replace it with any other super user (for example:abc) created ...
3
votes
3answers
198 views

Domain Admin Account Accessing SQL Server

I was monitoring some SQL calls using SQL Server Profiler and noticed a Domain Admin account accessing SQL quite a bit. We do not have a DBA at this point. There are two developers and I am one of ...
0
votes
0answers
58 views

Different security levels for one SSRS report

I am trying to grant limited access for one report per user. For example, the report consist of multiple cities and each city has profit info within them but the users should only be able to see the ...
0
votes
0answers
46 views

The security definer of my stored procedures suddenly changed on a shared hosting server

I'm on the verge of jumping down someone's throat and want to be sure I didn't somehow cause this. I am building a website on a shared server hosted by a top-three hosting company. Last night, while ...
0
votes
1answer
38 views

MySQL 8 roles - I'm probably missing something obvious

I'm trying to use roles in MySQL 8, and failing. I have read the documentation and as far as I can tell, I'm doing it right. Since this is a 'hello world' level attempt, I assume I'm missing something ...
1
vote
0answers
18 views

HQL Injection Question

This question popped into my head after reading this article. However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly: Is there ...
4
votes
5answers
634 views

Software need db owner permission to master database (sql2016)

We have a manufacturer whose software requires authorization for the master database (only db owner working). Unfortunately, the manufacturer can not tell us why this access to the master database is ...
0
votes
1answer
49 views

SQL Server : Is it necessary to disable SA user for security issues?

We have a website that will published in national grade with millions of users with Microsoft Sql Server database. I need to know is it necessary to disable SA login for security issues like DOS ...
1
vote
1answer
31 views

Prevent updating table using procedure in different database

This is my scenario: Windows User Gabe has db_owner access of database DB1. Windows User Gabe has db_reader on database DB2. When the user executes UPDATE DB2.dbo.Tbl1 SET X = 1, they get "The ...
1
vote
1answer
41 views

Disallow superusers and single-user mode in POSTGRESQL

I have a doubt about superusers and single-user mode. I want to restrict the access to a certain database, in a way that only those users which I gave privileges can see the structure of my database....
0
votes
1answer
40 views

differences in the authentication scheme - could it be because of Kerberos?

I am using this script to check the connections to my sql server: select C.client_net_address, S.host_name, c.session_id, c.net_transport, c.protocol_type, c.auth_scheme, s.program_name from sys....
1
vote
1answer
61 views

Deny Delete to An Active Directory Account in Sql Server

I want to deny an AD account to delete any record in sql server. How can i do that? DENY DELETE TO [usergorup\username] did not work. Is there another way?
0
votes
1answer
68 views

how to script server side permissions - specifically EXECUTE ON SYS.XP_PROP_OLEDB_PROVIDER?

I could not script the following server side permissions: GRANT VIEW DEFINITION ON LOGIN::[site_helpdesk] TO [Radhe] but thanks to the question below I found a solution to that: How to script out ...
1
vote
1answer
102 views

SQL Server Security - Encryption [closed]

I have requirement to store the some sensitive information in SQL Server 2016. Organization policy demands, it should be encrypted. Business Requirement: Data cannot be decrypted by DBA. Data cannot ...
0
votes
0answers
16 views

How to store Postgres password in configuration hibernate.properties

what is the correct way to provide PostgreSQL password in hibernate.properties(encrypted or plain). If encrypted, who is responsible for encryption and decryption Please post any doc which is helpful. ...
0
votes
1answer
30 views

SQL Server - Non Grantor - Alternative way to deny view list of database

We're having an instance by AWS RDS with SQL Server 2016. Lots of databases being in this instance. We need to create a login called test_user with public server role and db_datareader database role, ...
0
votes
0answers
40 views

How to access MS SQL Server databases securely without VPN

We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
4
votes
1answer
126 views

Is there any reason I shouldn't delete orphaned database users?

I've inherited a business application which has been around for c. 15 years composed of multiple databases that are all hosted on the same SQL Server (2012 SP4) instance. In all of the databases ...
3
votes
2answers
81 views

Find accounts with passwords that are not complex

I can see all the SQL Login passwords that enforce the password policy with this command SELECT * FROM sys.sql_logins WHERE is_policy_checked = 1 However, it seems that when the enforce password ...
0
votes
1answer
22 views

How to secure my data queried from my local MySQL server on a remote machine with root shared with untrusted entity?

I have a remote client machine put in a server center owned by an entity who must also have the root of the client machine according to industry regulations. The client machine runs a C++ program that ...
0
votes
1answer
84 views

SQL Server RLS vs Oracle FGAC [closed]

What is the difference between SQL Server RLS and Oracle FGAC. How to decide which one to go for? We already have both the products in place and teams to support the products.
3
votes
0answers
152 views

Can CyberArk Manage SQL Credentials To Synchronize Password Changes?

My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
1
vote
2answers
49 views

Find user who kicked off a SQL Agent job at runtime

I have inherited a breakglass procedure that allows certain users to kick off a SQL Agent job that inflates their privileges on the instance. It currently sends an email to say that it has been ...