Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

148 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
173 views

Mongodb 4.2 Brute Force Defense

Is there any tool or configurations for mongodb server to protect against brute force attacks on the user credentials? I found only authFailedDelayMs param witch Available in MongoDB Enterprise only (...
user avatar
4 votes
0 answers
401 views

What are PostgreSQL Security Labels?

What are PostgreSQL Security Labels and how/where to use them compared to GRANT?
user avatar
4 votes
1 answer
1k views

Flask mongodb assertion 13 not authorized for query on flask_session.sessions

Need help resetting mongodb back to its original state. We have a flask app running with mongodb with authentication turned off. Running on Ubuntu with std Flask. We tried ALL sorts of combinations ...
user avatar
4 votes
2 answers
64 views

Snooping-safe Vote tables

I have a table with both user_id and vote. They are stored together so each user can only give one vote. However it's also problematic because admins can simply read who voted what. Is there a way to ...
user avatar
  • 57
4 votes
0 answers
735 views

User can create in SSRS, but can't manage objects

We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to. It is SSRS 2008 R2, ...
user avatar
3 votes
0 answers
529 views

Can CyberArk Manage SQL Credentials To Synchronize Password Changes?

My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
user avatar
  • 1,913
3 votes
0 answers
157 views

Securing a Cassandra Cluster

We've managed to set up a Cassandra 2.2.6 cluster of two physical nodes (nodetool sees both of them, so I'm quite certain the cluster is indeed active). My steps to create the cluster were (this ...
user avatar
  • 131
3 votes
0 answers
476 views

Postgres role security for multi-tenant database

I have a multi-tenant application where the Postgres DB schemas are set up as follows: _admin (tables that are invisible in the UI to standard users but need to be read-accessible, common across all ...
user avatar
3 votes
0 answers
426 views

How to set minimal permissions to change SQL Azure Firewall rules

I have a desktop app that connects to SQL Azure database. Some users have dynamic IP addresses, and it is not possible to get them to use fixed addresses. I've written an ASP.NET page hosted on the ...
user avatar
  • 31
2 votes
0 answers
44 views

How to create logins in sql server based on the Azure Active Directory?

In my Azure environment I have many resources, and I have a virtual machine that contains my sql server database This is my virtual machine: What I would like to achieve is to create logins inside my ...
user avatar
2 votes
1 answer
95 views

Should I use a Domain User account to manage SQL Server (or other services)

As the SQL Server administrator for a server running inside a Windows Domain, I followed some rules: SQL service runs under a Domain User account (least privilege) "sa" has been disabled ...
user avatar
  • 133
2 votes
0 answers
48 views

How do I prevent PostgresQL users/roles from having access to any administrator functions?

When I create a user with CREATE ROLE user123 LOGIN on my system it is able to login and immediately perform \du and interact with pg_stat_activity, and probably many other things. I have ...
user avatar
  • 143
2 votes
0 answers
140 views

Questions and advice for complying with Federal tax information (FTI) Security Guidelines for Federal, State and Local Agencies per Publication 1075

I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website ...
user avatar
2 votes
0 answers
420 views

How to Clean Sensitive Data from SQL Server Dump Files

How do I clean a SQL Server dump file of confidential/PII/PHI information so I can prepare it for third party analysis? What am I looking for in the dump files and are there any automated tools to ...
user avatar
  • 315
2 votes
0 answers
137 views

Permissions on views/stored procedures and the referenced base tables in linked servers

I need help setting up security division between SELECTing and EXECUTEing from views and stored procedures and access to base tables referenced by those objects on linked servers on SQL Server 2012SP3....
user avatar
2 votes
0 answers
396 views

Data Security for SQL Server 2012 Standard Edition

I just wanted to know what my options were for securing and encrypting data for SQL Server 2012 standard edition? We originally were going to use Transparent Data Encryption for restful encryption, ...
user avatar
2 votes
0 answers
99 views

How to get the logins and Users automatically removed whenever anybody leaves a organization without any impact

I wanted to know is there any functionality already available in SQL Server which will automatically removes logins and Users in SQL Server, whenever anybody leaves a organization without any impact. ...
user avatar
2 votes
0 answers
380 views

security concerns over enabling data access for the current server

Included in the code of the creation of some stored procedures, I have the enabling of data access as you can see below. BEGIN TRY PRINT @@SERVERNAME PRINT DB_NAME() PRINT 'enable the ...
user avatar
2 votes
0 answers
102 views

Is this user-storage database system efficient, effective and secure?

I am using: PHP Version 5.2.17-MIT-BACKPORT-GnuTLS SQLite 2.8.17 I have a database called users, which currently has a table called root. There will be others, once I get all the rows for root ...
user avatar
  • 143
2 votes
0 answers
2k views

which role-permission database design?

I want to manage roles and permissions. Most of designs on web look like this tables: Users Roles UserRoles Permissions RolePermissions Here, what is permissions? I am thinking for such a design ...
user avatar
  • 61
2 votes
0 answers
413 views

PhpMyAdmin: UploadDir & SaveDir

Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755. I am the only one using phpmyadmin, but still, could I make this tighter? Thanks PHP 5.3.3 ...
user avatar
  • 171
2 votes
0 answers
1k views

ORACLE SSL using Microsoft Certificate Store for PKI

I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store. Client: Windows 7 64 bit with Oracle client 11.2.0.3.0 Server: Windows 2008 R2 64 bit with ...
user avatar
1 vote
0 answers
16 views

How to set administrative user in Mysql 5.7

I am trying to run a scan from Nessus against Mysql 5.7 database I am getting the following error: Ensure Only Administrative Users Have Full Database Access 'mysql.user' Perform the following actions ...
user avatar
1 vote
1 answer
35 views

MySQL server accessible from the internet nmap scan result

I have a MySQL database on a server which is accessible from the internet and I'm doing some security checks. A nmap script scan shows the information below. I'm curious if an attacker can derive ...
user avatar
1 vote
0 answers
32 views

Service Broker's SEND statement causes security context switch

We have triggers in multiple tables that will send messages to a Service Broker service upon INSERT, UPDATE and DELETE operations. These operations may be nested as parts of bigger, transactional ...
user avatar
  • 111
1 vote
0 answers
24 views

Azure SQL custom backup role

We are currently running an Elastic Pool within azure to host all our databases. We need to back up these to on-premise as well in case of an emergency, and for it we are trying to use sqlpackage. Now ...
user avatar
1 vote
0 answers
30 views

Azure SQL DB and SQL MI Security Concerns

I have 7 different SQL Managed Instances, which were newly migrated over from SQL VM. I also have 7 different Azure SQL Databases, which were also newly created. I want to make sure that I completely ...
user avatar
1 vote
0 answers
425 views

How to hide SQL Server connection string and SQL login password from Developers

We are using Microsoft Azure App Services to host some of our Web Apps. Web Apps connect to on-premises SQL Server over hybrid connections. When new Web App needs access to the on-prem SQL Server, a ...
user avatar
1 vote
1 answer
75 views

How to Hide Sql Server Fingerprint?

I have a sql server which being monitor by Nagios through snmp string. One day, i received some alert from nagios come with some sensitive information like: Critical Alert: dbi connect (Server name: ...
user avatar
  • 35
1 vote
1 answer
615 views

openssl s_client does not indicate that SQL Server is using TLS, however the connection is secure. How is that possible?

I am connecting to SQL Server 2017 using ODBC and MSSMS. The connection is not using TLS; I checked it using openssl s_client. However, the DBA assures me that the connection is secure. What ...
user avatar
1 vote
1 answer
138 views

Discover who changed SQL Server service state

There's any way to find out who stopped\restarted\started the following services ? SQL Server Database Engine SQL Server Agent SQL Server Analysis Services Thanks !
user avatar
1 vote
0 answers
105 views

MySQL Password Validation - No previous passwords

I wonder if there is any possibility to use the password validation for MySQL 5.6 (https://dev.mysql.com/doc/refman/5.6/en/validate-password.html) to prevent for example the last 4 passwords. The ...
user avatar
  • 11
1 vote
0 answers
19 views

HQL Injection Question

This question popped into my head after reading this article. However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly: Is there ...
user avatar
1 vote
0 answers
468 views

How to access MS SQL Server databases securely without VPN

We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
user avatar
  • 111
1 vote
0 answers
52 views

sql server connectivity broke down to server after its IP address has moved to a subnet. How to restore its connectivity?

I a server called Vermont on a different domain, with a trust relationship. I can ping the server there. But when I try to connect to it, from my SSMS I get the following error: I used to connect ...
user avatar
1 vote
0 answers
31 views

MS SQL 2008 R2, security and auditing

I have an 2008R2 SQL Server. There are a few AD groups added to the logins. Each group must have some permissions (and only these permissions if possible). Can someone help me with a few questions: ...
user avatar
  • 11
1 vote
1 answer
312 views

Linked Server Configuration using remote user logins

I'm trying to configure a Linked Server using remote logins reducing who has access to the linked server by taking advantage of the not be made option. For test purposes alone, I have used SA, ...
user avatar
  • 333
1 vote
0 answers
142 views

How to switch session role securely?

I'd like to setup a service through which my users can submit SQL queries to a database wherein I store some data. Users are assigned to organizations, and I've setup views that provide read access ...
user avatar
  • 111
1 vote
0 answers
1k views

Grant permissions over linked server

I need to grant select permissions to a sensitive table over the linked server. This table should only grant access to members of an AD group. I currently have other linked servers set up with remote ...
user avatar
  • 333
1 vote
1 answer
57 views

Is it possible to login to an Oracle schema using a certificate?

The question is based on having to deal with lots of automated processing (testing, mostly). As it stands, all the schemas used have the same well known password, which is stored in lots of ...
user avatar
  • 197
1 vote
0 answers
346 views

SSL certificate for MS SQL Server

I'm trying to implement SSL certificate on a SQL Server and I already tried two methods. I tried with lets encrypt service and self certificate generated on Powershell. In the first scenario I can ...
user avatar
1 vote
1 answer
45 views

SQL Server 11.0 and AD Groups

I have a user that has his Active Directory logon set to allow logging into a specific SQL Server, and that works fine. This user is also part of an AD Group that has access to a specific database on ...
user avatar
  • 11
1 vote
0 answers
40 views

Restrict Source Access to SQL Server Service Account

I have an Audit requirement to ensure that the service accounts (that connect to SQL Server) are not used by anyone but the by the APPLICATION SERVER itself. All other connections attempts must be ...
user avatar
1 vote
0 answers
2k views

Oracle 11g Select query returns NO ROW SELECTED but the table actually has data

In my production, There is a table named ABC under X schema. I have granted SELECT privilege on ABC table to another user named Z. When I execute the query SELECT COUNT(*) FROM X.ABC; as user Z it ...
user avatar
1 vote
0 answers
315 views

What does the WQL Select * from SQLService return 0 rows in WBEMTest mean?

So, I've been trying to solve the blue icon question mark on my sql server in SQL Server Management Studio by following the answer in the following link: Blue icon with question mark - what does it ...
user avatar
  • 111
1 vote
0 answers
115 views

xp_cmdshell - Enablement Consequences - Clarifications

Recently we have disabled a module which is dependent on xp_cmdshell. Though we are not directly using the xp_cmdshell (instead we are using the proxy), we would now like to disable the xp_cmdshell ...
user avatar
  • 645
1 vote
0 answers
37 views

Do any databases other than SAP ASE support key custodians?

SAP Sybase ASE supports the notion of a key custodian. This allows for a setup where the trust can be split between two roles: the database administrator and a key custodian. The database ...
user avatar
1 vote
1 answer
63 views

Block SSRS Developers from embedding SQL Statements in Report

Is there any way I can automatically block SSRS reports with embedded SQL from accessing my Databases? I want to force a standard practice of using Stored Procedures, so the DBAs can take back ...
user avatar
  • 1,058
1 vote
0 answers
37 views

a domain \user part of 2 different Domain security groups can piggy back both AD groups to get complete access?

Scenario: domain\user has permissions to connect (authenticate) to a SQL server using domain\security_group_1 which is not mapped to any DBs. domain\user is also a part of domain\security_group_2 ...
user avatar
1 vote
0 answers
52 views

Access Secondary with SQL Agent Account - Security Question

I have installed three SQL Server Instances on three different server and created an availability group using all three instances. The sql server engine service runs on all three instances with the ...
user avatar
  • 11