Questions tagged [security]
Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.
148
questions with no upvoted or accepted answers
4
votes
0
answers
173
views
Mongodb 4.2 Brute Force Defense
Is there any tool or configurations for mongodb server to protect against brute force attacks on the user credentials?
I found only authFailedDelayMs param witch Available in MongoDB Enterprise only (...
- 122
4
votes
0
answers
401
views
What are PostgreSQL Security Labels?
What are PostgreSQL Security Labels and how/where to use them compared to GRANT?
- 141
4
votes
1
answer
1k
views
Flask mongodb assertion 13 not authorized for query on flask_session.sessions
Need help resetting mongodb back to its original state.
We have a flask app running with mongodb with authentication turned off. Running on Ubuntu with std Flask. We tried ALL sorts of combinations ...
- 141
4
votes
2
answers
64
views
Snooping-safe Vote tables
I have a table with both user_id and vote. They are stored together so each user can only give one vote. However it's also problematic because admins can simply read who voted what. Is there a way to ...
- 57
4
votes
0
answers
735
views
User can create in SSRS, but can't manage objects
We have a user who can create, but is unable to manage objects in SSRS, even though he has content manager permissions and another user who has same permissions who is able to.
It is SSRS 2008 R2, ...
- 41
3
votes
0
answers
529
views
Can CyberArk Manage SQL Credentials To Synchronize Password Changes?
My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse ...
- 1,913
3
votes
0
answers
157
views
Securing a Cassandra Cluster
We've managed to set up a Cassandra 2.2.6 cluster of two physical nodes (nodetool sees both of them, so I'm quite certain the cluster is indeed active). My steps to create the cluster were (this ...
- 131
3
votes
0
answers
476
views
Postgres role security for multi-tenant database
I have a multi-tenant application where the Postgres DB schemas are set up as follows:
_admin (tables that are invisible in the UI to standard users but need to be read-accessible, common across all ...
- 131
3
votes
0
answers
426
views
How to set minimal permissions to change SQL Azure Firewall rules
I have a desktop app that connects to SQL Azure database.
Some users have dynamic IP addresses, and it is not possible to get them to use fixed addresses.
I've written an ASP.NET page hosted on the ...
- 31
2
votes
0
answers
44
views
How to create logins in sql server based on the Azure Active Directory?
In my Azure environment
I have many resources, and I have a virtual machine that contains my sql server database
This is my virtual machine:
What I would like to achieve is to
create logins inside my ...
- 14.8k
2
votes
1
answer
95
views
Should I use a Domain User account to manage SQL Server (or other services)
As the SQL Server administrator for a server running inside a Windows Domain, I followed some rules:
SQL service runs under a Domain User account (least privilege)
"sa" has been disabled
...
- 133
2
votes
0
answers
48
views
How do I prevent PostgresQL users/roles from having access to any administrator functions?
When I create a user with CREATE ROLE user123 LOGIN on my system it is able to login and immediately perform \du and interact with pg_stat_activity, and probably many other things.
I have ...
- 143
2
votes
0
answers
140
views
Questions and advice for complying with Federal tax information (FTI) Security Guidelines for Federal, State and Local Agencies per Publication 1075
I've been able to find writings on compliance topics (e.g. HIPAA, SARBANES-OXLEY, PCI DSS) but I haven't found much on FTI (Federal tax information) and Publication 1075 outside of the IRS website ...
- 41
2
votes
0
answers
420
views
How to Clean Sensitive Data from SQL Server Dump Files
How do I clean a SQL Server dump file of confidential/PII/PHI information so I can prepare it for third party analysis? What am I looking for in the dump files and are there any automated tools to ...
- 315
2
votes
0
answers
137
views
Permissions on views/stored procedures and the referenced base tables in linked servers
I need help setting up security division between SELECTing and EXECUTEing from views and stored procedures and access to base tables referenced by those objects on linked servers on SQL Server 2012SP3....
2
votes
0
answers
396
views
Data Security for SQL Server 2012 Standard Edition
I just wanted to know what my options were for securing and encrypting data for SQL Server 2012 standard edition? We originally were going to use Transparent Data Encryption for restful encryption, ...
- 121
2
votes
0
answers
99
views
How to get the logins and Users automatically removed whenever anybody leaves a organization without any impact
I wanted to know is there any functionality already available in SQL Server which will automatically removes logins and Users in SQL Server, whenever anybody leaves a organization without any impact. ...
2
votes
0
answers
380
views
security concerns over enabling data access for the current server
Included in the code of the creation of some stored procedures,
I have the enabling of data access as you can see below.
BEGIN TRY
PRINT @@SERVERNAME
PRINT DB_NAME()
PRINT 'enable the ...
- 14.8k
2
votes
0
answers
102
views
Is this user-storage database system efficient, effective and secure?
I am using:
PHP Version 5.2.17-MIT-BACKPORT-GnuTLS
SQLite 2.8.17
I have a database called users, which currently has a table called root. There will be others, once I get all the rows for root ...
- 143
2
votes
0
answers
2k
views
which role-permission database design?
I want to manage roles and permissions. Most of designs on web look like this
tables:
Users
Roles
UserRoles
Permissions
RolePermissions
Here, what is permissions? I am thinking for such a design ...
- 61
2
votes
0
answers
413
views
PhpMyAdmin: UploadDir & SaveDir
Regarding UploadDir & SaveDir in phpmyadmin, I have them both set to './save' with permissions at 755.
I am the only one using phpmyadmin, but still, could I make this tighter?
Thanks
PHP 5.3.3 ...
- 171
2
votes
0
answers
1k
views
ORACLE SSL using Microsoft Certificate Store for PKI
I am trying to set up PKI SSL authentication between client and server using a Microsoft Certificate Store.
Client: Windows 7 64 bit with Oracle client 11.2.0.3.0
Server: Windows 2008 R2 64 bit with ...
1
vote
0
answers
16
views
How to set administrative user in Mysql 5.7
I am trying to run a scan from Nessus against Mysql 5.7 database
I am getting the following error:
Ensure Only Administrative Users Have Full Database Access 'mysql.user'
Perform the following actions ...
- 111
1
vote
1
answer
35
views
MySQL server accessible from the internet nmap scan result
I have a MySQL database on a server which is accessible from the internet and I'm doing some security checks. A nmap script scan shows the information below. I'm curious if an attacker can derive ...
Willy Wartaal
1
vote
0
answers
32
views
Service Broker's SEND statement causes security context switch
We have triggers in multiple tables that will send messages to a Service Broker service upon INSERT, UPDATE and DELETE operations. These operations may be nested as parts of bigger, transactional ...
- 111
1
vote
0
answers
24
views
Azure SQL custom backup role
We are currently running an Elastic Pool within azure to host all our databases.
We need to back up these to on-premise as well in case of an emergency, and for it we are trying to use sqlpackage.
Now ...
- 11
1
vote
0
answers
30
views
Azure SQL DB and SQL MI Security Concerns
I have 7 different SQL Managed Instances, which were newly migrated over from SQL VM. I also have 7 different Azure SQL Databases, which were also newly created.
I want to make sure that I completely ...
1
vote
0
answers
425
views
How to hide SQL Server connection string and SQL login password from Developers
We are using Microsoft Azure App Services to host some of our Web Apps.
Web Apps connect to on-premises SQL Server over hybrid connections.
When new Web App needs access to the on-prem SQL Server, a ...
- 4,408
1
vote
1
answer
75
views
How to Hide Sql Server Fingerprint?
I have a sql server which being monitor by Nagios through snmp string.
One day, i received some alert from nagios come with some sensitive information like:
Critical Alert: dbi connect (Server name: ...
- 35
1
vote
1
answer
615
views
openssl s_client does not indicate that SQL Server is using TLS, however the connection is secure. How is that possible?
I am connecting to SQL Server 2017 using ODBC and MSSMS. The connection is not using TLS; I checked it using openssl s_client. However, the DBA assures me that the connection is secure.
What ...
- 11
1
vote
1
answer
138
views
Discover who changed SQL Server service state
There's any way to find out who stopped\restarted\started the following services ?
SQL Server Database Engine
SQL Server Agent
SQL Server Analysis Services
Thanks !
1
vote
0
answers
105
views
MySQL Password Validation - No previous passwords
I wonder if there is any possibility to use the password validation for MySQL 5.6 (https://dev.mysql.com/doc/refman/5.6/en/validate-password.html) to prevent for example the last 4 passwords.
The ...
- 11
1
vote
0
answers
19
views
HQL Injection Question
This question popped into my head after reading this article.
However, the more I read about this topic, the more it seems like a Dynamic SQL security issues. So i have 2 questions mainly:
Is there ...
- 934
1
vote
0
answers
468
views
How to access MS SQL Server databases securely without VPN
We have an application that must directly access an MS SQL database. The database is in a remote location. Therefore, at the moment, we use a VPN connection which works fine and appears to be safe. ...
- 111
1
vote
0
answers
52
views
sql server connectivity broke down to server after its IP address has moved to a subnet. How to restore its connectivity?
I a server called Vermont on a different domain, with a trust relationship.
I can ping the server there.
But when I try to connect to it, from my SSMS I get the following error:
I used to connect ...
- 14.8k
1
vote
0
answers
31
views
MS SQL 2008 R2, security and auditing
I have an 2008R2 SQL Server.
There are a few AD groups added to the logins.
Each group must have some permissions (and only these permissions if possible).
Can someone help me with a few questions:
...
- 11
1
vote
1
answer
312
views
Linked Server Configuration using remote user logins
I'm trying to configure a Linked Server using remote logins reducing who has access to the linked server by taking advantage of the not be made option. For test purposes alone, I have used SA, ...
- 333
1
vote
0
answers
142
views
How to switch session role securely?
I'd like to setup a service through which my users can submit SQL queries to a database wherein I store some data. Users are assigned to organizations, and I've setup views that provide read access ...
- 111
1
vote
0
answers
1k
views
Grant permissions over linked server
I need to grant select permissions to a sensitive table over the linked server. This table should only grant access to members of an AD group. I currently have other linked servers set up with remote ...
- 333
1
vote
1
answer
57
views
Is it possible to login to an Oracle schema using a certificate?
The question is based on having to deal with lots of automated processing (testing, mostly). As it stands, all the schemas used have the same well known password, which is stored in lots of ...
- 197
1
vote
0
answers
346
views
SSL certificate for MS SQL Server
I'm trying to implement SSL certificate on a SQL Server and I already tried two methods. I tried with lets encrypt service and self certificate generated on Powershell.
In the first scenario I can ...
1
vote
1
answer
45
views
SQL Server 11.0 and AD Groups
I have a user that has his Active Directory logon set to allow logging into a specific SQL Server, and that works fine. This user is also part of an AD Group that has access to a specific database on ...
- 11
1
vote
0
answers
40
views
Restrict Source Access to SQL Server Service Account
I have an Audit requirement to ensure that the service accounts (that connect to SQL Server) are not used by anyone but the by the APPLICATION SERVER itself.
All other connections attempts must be ...
1
vote
0
answers
2k
views
Oracle 11g Select query returns NO ROW SELECTED but the table actually has data
In my production, There is a table named ABC under X schema. I have granted SELECT privilege on ABC table to another user named Z. When I execute the query
SELECT COUNT(*) FROM X.ABC;
as user Z it ...
1
vote
0
answers
315
views
What does the WQL Select * from SQLService return 0 rows in WBEMTest mean?
So, I've been trying to solve the blue icon question mark on my sql server in SQL Server Management Studio by following the answer in the following link:
Blue icon with question mark - what does it ...
- 111
1
vote
0
answers
115
views
xp_cmdshell - Enablement Consequences - Clarifications
Recently we have disabled a module which is dependent on xp_cmdshell. Though we are not directly using the xp_cmdshell (instead we are using the proxy), we would now like to disable the xp_cmdshell ...
- 645
1
vote
0
answers
37
views
Do any databases other than SAP ASE support key custodians?
SAP Sybase ASE supports the notion of a key custodian. This allows for a setup where the trust can be split between two roles: the database administrator and a key custodian. The database ...
1
vote
1
answer
63
views
Block SSRS Developers from embedding SQL Statements in Report
Is there any way I can automatically block SSRS reports with embedded SQL from accessing my Databases?
I want to force a standard practice of using Stored Procedures, so the DBAs can take back ...
- 1,058
1
vote
0
answers
37
views
a domain \user part of 2 different Domain security groups can piggy back both AD groups to get complete access?
Scenario:
domain\user has permissions to connect (authenticate) to a SQL server using domain\security_group_1 which is not mapped to any DBs.
domain\user is also a part of domain\security_group_2 ...
- 21
1
vote
0
answers
52
views
Access Secondary with SQL Agent Account - Security Question
I have installed three SQL Server Instances on three different server and created an availability group using all three instances.
The sql server engine service runs on all three instances with the ...
- 11