Questions tagged [security]
Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.
136
questions with no upvoted or accepted answers
4
votes
0answers
74 views
Mongodb 4.2 Brute Force Defense
Is there any tool or configurations for mongodb server to protect against brute force attacks on the user credentials?
I found only authFailedDelayMs param witch Available in MongoDB Enterprise only (...
4
votes
1answer
848 views
Flask mongodb assertion 13 not authorized for query on flask_session.sessions
Need help resetting mongodb back to its original state.
We have a flask app running with mongodb with authentication turned off. Running on Ubuntu with std Flask. We tried ALL sorts of combinations ...
4
votes
2answers
60 views
Snooping-safe Vote tables
I have a table with both user_id and vote. They are stored together so each user can only give one vote. However it's also problematic because admins can simply read who voted what. Is there a way to ...
4
votes
0answers
726 views
User can create in SSRS, but can't manage objects
We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to.
It is SSRS 2008 R2, ...
3
votes
0answers
355 views
Can CyberArk Manage SQL Credentials To Synchronize Password Changes?
My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
3
votes
0answers
362 views
What are PostgreSQL Security Labels?
What are PostgreSQL Security Labels and how/where to use them compared to GRANT?
3
votes
1answer
526 views
Creating Report Subscriptions on report that are using a Shared data source that uses Windows Integrated Security
We've recently deployed a new SSRS Server 2012, that can use Windows Integrated Security. We configured the servers to properly use Kerberos authentication and we solved the double hop issue.
Now, ...
3
votes
0answers
154 views
Securing a Cassandra Cluster
We've managed to set up a Cassandra 2.2.6 cluster of two physical nodes (nodetool sees both of them, so I'm quite certain the cluster is indeed active). My steps to create the cluster were (this ...
3
votes
0answers
453 views
Postgres role security for multi-tenant database
I have a multi-tenant application where the Postgres DB schemas are set up as follows:
_admin (tables that are invisible in the UI to standard users but need to be read-accessible, common across all ...
3
votes
0answers
336 views
How to set minimal permissions to change SQL Azure Firewall rules
I have a desktop app that connects to SQL Azure database.
Some users have dynamic IP addresses, and it is not possible to get them to use fixed addresses.
I've written an ASP.NET page hosted on the ...
2
votes
1answer
43 views
Should I use a Domain User account to manage SQL Server (or other services)
As the SQL Server administrator for a server running inside a Windows Domain, I followed some rules:
SQL service runs under a Domain User account (least privilege)
"sa" has been disabled
...
2
votes
0answers
46 views
How do I prevent PostgresQL users/roles from having access to any administrator functions?
When I create a user with CREATE ROLE user123 LOGIN on my system it is able to login and immediately perform \du and interact with pg_stat_activity, and probably many other things.
I have ...
2
votes
0answers
123 views
Questions and advice for complying with Federal tax information (FTI) Security Guidelines for Federal, State and Local Agencies per Publication 1075
I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website ...
2
votes
0answers
335 views
How to Clean Sensitive Data from SQL Server Dump Files
How do I clean a SQL Server dump file of confidential/PII/PHI information so I can prepare it for third party analysis? What am I looking for in the dump files and are there any automated tools to ...
2
votes
0answers
134 views
Permissions on views/stored procedures and the referenced base tables in linked servers
I need help setting up security division between SELECTing and EXECUTEing from views and stored procedures and access to base tables referenced by those objects on linked servers on SQL Server 2012SP3....
2
votes
1answer
155 views
Permission for business logic layer & application
I'm very new into db development and currently working on my first production app.
I learned that I would need a business logic layer (BLL) to authenticate and authorize users, for example:
John can ...
2
votes
0answers
375 views
Data Security for SQL Server 2012 Standard Edition
I just wanted to know what my options were for securing and encrypting data for SQL Server 2012 standard edition? We originally were going to use Transparent Data Encryption for restful encryption, ...
2
votes
0answers
90 views
How to get the logins and Users automatically removed whenever anybody leaves a organization without any impact
I wanted to know is there any functionality already available in SQL Server which will automatically removes logins and Users in SQL Server, whenever anybody leaves a organization without any impact. ...
2
votes
0answers
331 views
security concerns over enabling data access for the current server
Included in the code of the creation of some stored procedures,
I have the enabling of data access as you can see below.
BEGIN TRY
PRINT @@SERVERNAME
PRINT DB_NAME()
PRINT 'enable the ...
2
votes
0answers
102 views
Is this user-storage database system efficient, effective and secure?
I am using:
PHP Version 5.2.17-MIT-BACKPORT-GnuTLS
SQLite 2.8.17
I have a database called users, which currently has a table called root. There will be others, once I get all the rows for root ...
2
votes
0answers
2k views
which role-permission database design?
I want to manage roles and permissions. Most of designs on web look like this
tables:
Users
Roles
UserRoles
Permissions
RolePermissions
Here, what is permissions? I am thinking for such a design ...
2
votes
0answers
404 views
PhpMyAdmin: UploadDir & SaveDir
Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755.
I am the only one using phpmyadmin, but still, could I make this tighter?
Thanks
PHP 5.3.3 ...
2
votes
0answers
1k views
ORACLE SSL using Microsoft Certificate Store for PKI
I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store.
Client: Windows 7 64 bit with Oracle client 11.2.0.3.0
Server: Windows 2008 R2 64 bit with ...
2
votes
2answers
209 views
Secure MySQL-Server completely (disable ability to reset root-password)
is there a way to secure a mysql-server so no one can reset a password via --init-file-startup?
there should only be a:
"root" user (password not known to anyone else than person a)
"system" user (...
1
vote
0answers
291 views
How to hide SQL Server connection string and SQL login password from Developers
We are using Microsoft Azure App Services to host some of our Web Apps.
Web Apps connect to on-premises SQL Server over hybrid connections.
When new Web App needs access to the on-prem SQL Server, a ...
1
vote
1answer
785 views
Changing the login name for user dbo
I have a database where the owner is Login1 but the username dbo is assigned to Login - login2. I understand in order to change the login name for the username dbo to sa I will have to use the below
...
1
vote
1answer
65 views
How to Hide Sql Server Fingerprint?
I have a sql server which being monitor by Nagios through snmp string.
One day, i received some alert from nagios come with some sensitive information like:
Critical Alert: dbi connect (Server name: ...
1
vote
1answer
286 views
openssl s_client does not indicate that SQL Server is using TLS, however the connection is secure. How is that possible?
I am connecting to SQL Server 2017 using ODBC and MSSMS. The connection is not using TLS; I checked it using openssl s_client. However, the DBA assures me that the connection is secure.
What ...
1
vote
1answer
90 views
Discover who changed SQL Server service state
There's any way to find out who stopped\restarted\started the following services ?
SQL Server Database Engine
SQL Server Agent
SQL Server Analysis Services
Thanks !
1
vote
0answers
104 views
MySQL Password Validation - No previous passwords
I wonder if there is any possibility to use the password validation for MySQL 5.6 (https://dev.mysql.com/doc/refman/5.6/en/validate-password.html) to prevent for example the last 4 passwords.
The ...
1
vote
0answers
19 views
HQL Injection Question
This question popped into my head after reading this article.
However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly:
Is there ...
1
vote
0answers
278 views
How to access MS SQL Server databases securely without VPN
We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
1
vote
0answers
42 views
sql server connectivity broke down to server after its IP address has moved to a subnet. How to restore its connectivity?
I a server called Vermont on a different domain, with a trust relationship.
I can ping the server there.
But when I try to connect to it, from my SSMS I get the following error:
I used to connect ...
1
vote
0answers
26 views
MS SQL 2008 R2, security and auditing
I have an 2008R2 SQL Server.
There are a few AD groups added to the logins.
Each group must have some permissions (and only these permissions if possible).
Can someone help me with a few questions:
...
1
vote
1answer
148 views
Linked Server Configuration using remote user logins
I'm trying to configure a Linked Server using remote logins reducing who has access to the linked server by taking advantage of the not be made option. For test purposes alone, I have used SA, ...
1
vote
0answers
79 views
How to switch session role securely?
I'd like to setup a service through which my users can submit SQL queries to a database wherein I store some data. Users are assigned to organizations, and I've setup views that provide read access ...
1
vote
0answers
1k views
Grant permissions over linked server
I need to grant select permissions to a sensitive table over the linked server. This table should only grant access to members of an AD group. I currently have other linked servers set up with remote ...
1
vote
1answer
47 views
Is it possible to login to an Oracle schema using a certificate?
The question is based on having to deal with lots of automated processing (testing, mostly). As it stands, all the schemas used have the same well known password, which is stored in lots of ...
1
vote
0answers
295 views
SSL certificate for MS SQL Server
I'm trying to implement SSL certificate on a SQL Server and I already tried two methods. I tried with lets encrypt service and self certificate generated on Powershell.
In the first scenario I can ...
1
vote
1answer
43 views
SQL Server 11.0 and AD Groups
I have a user that has his Active Directory logon set to allow logging into a specific SQL Server, and that works fine. This user is also part of an AD Group that has access to a specific database on ...
1
vote
0answers
38 views
Restrict Source Access to SQL Server Service Account
I have an Audit requirement to ensure that the service accounts (that connect to SQL Server) are not used by anyone but the by the APPLICATION SERVER itself.
All other connections attempts must be ...
1
vote
0answers
2k views
Oracle 11g Select query returns NO ROW SELECTED but the table actually has data
In my production, There is a table named ABC under X schema. I have granted SELECT privilege on ABC table to another user named Z. When I execute the query
SELECT COUNT(*) FROM X.ABC;
as user Z it ...
1
vote
0answers
290 views
What does the WQL Select * from SQLService return 0 rows in WBEMTest mean?
So, I've been trying to solve the blue icon question mark on my sql server in SQL Server Management Studio by following the answer in the following link:
Blue icon with question mark - what does it ...
1
vote
0answers
108 views
xp_cmdshell - Enablement Consequences - Clarifications
Recently we have disabled a module which is dependent on xp_cmdshell. Though we are not directly using the xp_cmdshell (instead we are using the proxy), we would now like to disable the xp_cmdshell ...
1
vote
0answers
31 views
Do any databases other than SAP ASE support key custodians?
SAP Sybase ASE supports the notion of a key custodian. This allows for a setup where the trust can be split between two roles: the database administrator and a key custodian. The database ...
1
vote
1answer
57 views
Block SSRS Developers from embedding SQL Statements in Report
Is there any way I can automatically block SSRS reports with embedded SQL from accessing my Databases?
I want to force a standard practice of using Stored Procedures, so the DBAs can take back ...
1
vote
0answers
36 views
a domain \user part of 2 different Domain security groups can piggy back both AD groups to get complete access?
Scenario:
domain\user has permissions to connect (authenticate) to a SQL server using domain\security_group_1 which is not mapped to any DBs.
domain\user is also a part of domain\security_group_2 ...
1
vote
0answers
49 views
Access Secondary with SQL Agent Account - Security Question
I have installed three SQL Server Instances on three different server and created an availability group using all three instances.
The sql server engine service runs on all three instances with the ...
1
vote
0answers
177 views
I need advice on storing application level encrypted data
I just want to ask, what is your solution on storing encrypted data on database? And also how you do searching on it?
For now the subject database server is mysql.
Disk level encryption is not an ...
1
vote
0answers
31 views
Switch Between Windows Authenticated Users On Single Windows Account
We have a CRM that has been developed in house in Microsoft Access 2003. We are also in the process of moving from an MS Access backend to a SQL Server backend.
I have been researching different ...
