Questions tagged [security]
Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.
1,083
questions
0
votes
0
answers
17
views
LocalDB with linked table to SQL Server error 7412 switching from non-admin to admin privileges
We are experiencing a strange issue using a localDB with linked tables to an SQL Server instance using SQL 2019. We see the issue in our own software but can also reproduce it using SQLSMS.
The steps ...
0
votes
1
answer
43
views
Can I password protect a specific ms sql database view?
I have an MS SQL database with a View that contains sensitive data in one column. Typically, users will consume this View in Power BI. As additional security, is it possible to password protect the ...
0
votes
2
answers
76
views
Tool for monitoring changes to data in a database
I regularly back up my MariaDB databases using mariadb-dump (mariadb's mysqldump).
However, I want to ensure data integrity in either of these cases:
a vulnerability in an application using a ...
0
votes
0
answers
212
views
Microsoft SQL Server Extension Agent - Where is it enabled
This is on a SQL Server 2016 SP1-CU3
Recently, these entries are appearing in our Security log table which traces any grants, revokes, user creation, etc.
And the host that is dropping these users ...
2
votes
2
answers
50
views
SQL Server DWH architecture question
We have SQL Server DWH server. It has dwh_raw, dwh_prod and so on databases with client data, business operations.
Now there is a task to allocate new data - on employees, their salaries and so on.
Is ...
1
vote
1
answer
101
views
What type of queries are considered as SQL injection?
I was testing efficacy of a paid Database security solution which has the ability to detect and block SQLi attack. For the testing purpose I have tried the following query against a PostgreSQL ...
2
votes
0
answers
28
views
Error when creating policy in Oracle Label Security
I ran into a "failure to create trigger" error when creating policy in Oracle Label Security. Here's my code:
-- step3: Creating a Labeling Function for a Policy
CREATE OR REPLACE FUNCTION ...
1
vote
0
answers
18
views
How to securely limit columns in postgres logical replication?
The docs currently have this to say about publications with specified column lists:
The choice of columns can be based on behavioral or performance reasons. However, do not rely on this feature for ...
1
vote
3
answers
145
views
What are some sensible approaches for dealing with 4,000 vulnerabilities across 700 databases in 70 servers
I'm looking for ideas here. I've inherited a large SQL estate with multiple servers in multiple configs that has grown over 10-15 years with no specific DBA-skilled individual in charge. I'm the first ...
1
vote
1
answer
37
views
SAGE ODBC driver - minimum required folder permisions
I have a website which I want to connect to SAGE ACCDATA folder (which resides on a different server but same network to the intranet server) using their proprietary ODBC driver.
For security purposes ...
5
votes
2
answers
254
views
Can I change the owner of the cdc schema?
I've enabled Change Data Capture (CDC) on a database using exec sys.sp_cdc_enable_db
This creates a new cdc schema which is owned by the cdc user
select
s.*
, dp.name
from sys.schemas as s
...
1
vote
0
answers
21
views
search_path setting interaction when set for a function, versus role
I have a role called 'kube' with limited grants; those required to call functions in the api schema. This includes access to the "shared" schema that specifies user-defined used in the ...
1
vote
0
answers
286
views
CLR unloaded due to security data definition language
Today, we got a very weird situation. We added a SQL login to our database server. After adding this login, SQL unloaded a critical CLR routine "due to security data definition language" (...
1
vote
1
answer
243
views
What is the difference between a securable and permission in SQL Server?
In Microsoft SQL Server you have the possibility to set permissions at server and database level. You are also able to select a server login or database user and then set securables. I am wondering ...
6
votes
5
answers
3k
views
SQL Server with multiple databases (one per client) - what is the best security practice in terms of logins/users/permissions?
We have multiple SQL Servers with each holding dozens of databases - one per client (a client in this case means a customer organization). These databases are accessed via an application, but the ...
0
votes
2
answers
57
views
Making a database publicly readable to anyone on the Internet [closed]
Say that I have some data that is publicly available to begin (like an archive of hackernews stories), and I would like to make it available publicly in a sql database that is world-accessible. The ...
2
votes
1
answer
452
views
Can I revoke database permissions on "NT AUTHORITY\SYSTEM" but still let it have the "sysadmin" role?
I need to implement this: https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2020-12-16/finding/V-213934
In our instance IsClustered and IsHadrEnabled are both 0.
Using an automated tool it ...
10
votes
6
answers
3k
views
Is this SQL Procedure "injection proof"?
Most all answers and examples of SQL injection are showing some form of dynamic SQL or interpreting parameters as SQL.
I haven't been able to find an example of the "correct" way. Microsoft ...
0
votes
0
answers
16
views
Backup SQL Server on a shared folder from Azure DevOps / Command line [duplicate]
I need to back up my database using a command line instruction. I launch the backup instruction from a Azure DevOps Release Pipeline to back up my SQL server database on a share folder on another ...
1
vote
1
answer
410
views
Is there a way for mongodb clients to connect to mongodb server (SSL/TLS enabled) without client certificates?
I am trying to setup a MongoDB with SSL/TLS enabled. I'm just wondering is there a way for clients to connect to my mongodb server without having a client certificate that would not compromise the ...
2
votes
0
answers
76
views
How to enable Database Auditing on SQL server
I want to audit SQL database activities, but when I am trying to enable Database Level Adut specification, it is capturing all activities that is done from application side and also from queries that ...
5
votes
2
answers
380
views
Is it secure to have database login in a PHP file? Other options?
I'm a DB and SQL beginner. I'm putting together a basic PHP app that has a few SQL queries. In all my searching and learning, every example accessed the database by first logging in. Makes sense, but ...
1
vote
1
answer
108
views
Why is to_char used when doing a divide by 0 in Oracle based SQLi?
For conditional-error-based SQLi, instead of writing 1/0 directly like MYSQL, we need to write to_char(1/0) for Oracle, what is the reason behind this? Example,
Oracle:
SELECT CASE WHEN (YOUR-...
2
votes
2
answers
299
views
Revoke select on sys.database_principals
Following a request from the Security Team, do you think is there any issue if I revoke access to these tables?
Use Master
GO
REVOKE SELECT ON sys.database_principals TO PUBLIC;
REVOKE SELECT ON sys....
4
votes
1
answer
123
views
SQL Server data confidentiality in case of intrusion of machine host
I have to premit that i am a programmer, and i am trying to learn a bit about DBA even if i don't have the same background.
I am trying to understand what security provide, and how to use, encryption ...
1
vote
1
answer
611
views
using encrypted password in xp_cmdshell command
Dears ,
i am trying to make the mapped drive visible to SQL server and as a security requirement, I need to use user name and encrypted password because this will be saved on the logs if it is plain ...
1
vote
1
answer
59
views
How does MySQL maintain confidentiality of files?
In a DBMS like MySQL, are the underlying files that contain the data encrypted since we want to have role and user based control? If they are encrypted, what encryption keys and algorithms are used? ...
2
votes
0
answers
24
views
Is this the best practice for separating all records by user company?
This is more of a general database question than specifically a Prisma question, but the implementation I have is written using Prisma connected to MySQL.
Take the following part of my schema.prisma:
...
1
vote
0
answers
63
views
remove unix user named postgres after complete uninstallation of postgresql
I'm running MX Linux 21 and recently installed PostgreSQL-13; I wanted postgres to have read, write and execute access to a certain folder therefore I added the unix user postgres to the group of ...
3
votes
1
answer
715
views
How to enable authentication logs in Firebird 2.5?
I downloaded Firebird 2.5 from the official website and installed on a Linux machine. The install location is /opt/firebird.
I want to be able to view authentication attempt logs for security reasons (...
1
vote
1
answer
57
views
How to list the permissions needed for a role / user to run a query / view successfully (in an automated manner)?
Suppose I have queries / views like this:
select
internal.companies._cid,
internal.companies.name,
src1.employees.year,
src1.employees.count
from internal.companies
join src1....
1
vote
0
answers
87
views
MSSQL Server Database Trigger Permissions - issue after migrating from 2008 to 2017 Server
I have some triggers set up on a database (Dynamics NAV) across various tables for Insert, Update, Delete. The triggers write to a separate database to log the DB, Table, RowId and date/time. The ...
1
vote
1
answer
176
views
Cannot run nodetool commands after enabling JMX authentication in DSE
I would like to use these two pages to enable DSE Unified Authentication and realize a secure environment.
I have tried to configure it but it does not work.
How is it as a symptom.
When I type ...
3
votes
1
answer
977
views
The Trustworthy option should be disabled but what is an alternative?
I run vulnerability assessment report in SQL Server 2016 and I received this issue
VA1102 The Trustworthy bit should be disabled on all databases except
MSDB
The reason of setting Trustworthy to ...
1
vote
1
answer
40
views
What does the term "server" mean in this context?
I am currently familiarizing myself with SQL Server security. During the process, I came across the following text passage.
Windows-level principals are generally domain and local server user ...
1
vote
2
answers
226
views
What's the best way of going about storing information from different groups of users?
In my application, users (and all data) is grouped by company. So, for example, every customer in the database has a company assigned to it, as does every product etc. The user can log in with their ...
0
votes
0
answers
34
views
Postgres - basic security settings
I'm setting up a PostgreSQL instance for some logging data (non-critical). It will be accessible from internet. It's hosted on an azure VM.
I'm wondering what would be a decent setup to have basic ...
1
vote
1
answer
65
views
SQL security clarification
With SQL server, do default roles 'trump' defined securables and/or custom roles?
I am cleaning up security on my servers, and I have accounts that have datareader membership to the database, ...
4
votes
2
answers
945
views
What ports to open for sql server behind secure domain firewall
We are trying to solve connectivity issues for one of the app trying to pull data from very secured sql server behind firewall. I am not that expertise in security but need help on how to proceed in ...
0
votes
0
answers
135
views
When rebuilding sql server on a new machine, should SMK be restored prior to or after restoring system dbs?
Service Master key is at top of sql server encryption hierarchy. Linked server, credentials, database master key (if any) are encrypted using the service master key.
When rebuilding a sql server using ...
0
votes
0
answers
154
views
Mariadb equivalent to MySQL CONNECTION_CONTROL
MySQL introduced a security plugin library in version 5.7.17 including the plugin CONNECTION_CONTROL, which checks incoming connection attempts and adds a delay to server responses as a result of ...
0
votes
1
answer
287
views
Is safe to allow Database accessible from internet
We have a database that many clients need to read/write via internet.
There are two methods to deploy:
(A) [Database server] <---internet/SSL---> [Clients]: Allow database can be directly ...
0
votes
1
answer
111
views
How to switch session user using trusted context in db2cmd?
I would like to connect to Db2 database with user "appuser1" and then switching session user to "user1".
In Db2 v11.5.7 on Linux I connected to server using SSH.
I connected to ...
0
votes
1
answer
61
views
How secure is a local harddrive stored database?
I am currently creating a database that contains sensitive data such client names, addresses, etc. I have never worked with the setting up of servers but my research tells me to either use a cloud ...
0
votes
0
answers
118
views
How to find statement causing "The user does not have permission to perform this action." in Azure SQL Database?
I ran a Kusto query:
AzureDiagnostics
| where TimeGenerated > ago(1d)
| where Category == "Errors" and error_number_d == 297
| summarize count(), min(TimeGenerated), max(TimeGenerated) ...
1
vote
1
answer
1k
views
[ SQL Error 15173 ]Unable to drop a SQL Server Login (Login is a AD Group)
Recently I have added a SQL Server Login and later want to drop it.
But I am seeing below issue, can you please see what is my miss here.
USE [master]
GO
/****** Object: Login [] Script Date: 5-6-...
1
vote
0
answers
90
views
postgresql is my approach to row-based access control not simpler and more efficient under my stated assumptions?
When you have a 3 tier system with an application server in the middle, using a single database connection user but managing application users differently as it is typically done, how do you implement ...
4
votes
1
answer
150
views
Is an SSL Certificate Authority Chain "Secret"
We've recently signed up to use MariaDB's SkySQL package, however are new to the use of SSL Certificate Chains when connecting (having only really used SSH tunnels in the past).
We have the key which ...
1
vote
1
answer
2k
views
Restrict access to a new schema to a specific role despite users having db_datareader?
I'm working in a SQL Server 2016 database that is not of my design nor can I fundamentally change the security structure. I know it is likely trash/worst practice but I have to play the hand I am ...
17
votes
5
answers
4k
views
Can ransomware embed itself in to a SQL backup file?
One of the best protections against ransomware is to back up all of your database files to a completely separate system. Which we have done.
But one thought is the backup of the database could ...