Questions tagged [security]

Allowing users to access only the data they are authorized to access. It also encompasses protection of data during movement on the network and storage on disks and backups.

Filter by
Sorted by
Tagged with
86
votes
6answers
12k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
41
votes
4answers
126k views

How do I assign an entire Active Directory group security access in SQL Server 2008?

I would like to use integrated security with my internal application which is all on a domain. Unfortunately, I've never been able to get this to work well. I would like to assign an entire Exchange ...
37
votes
1answer
9k views

MySQL : Why are there "test" entries in mysql.db?

Recently, I posted an answer to a question about mysql.db. Then, I got to thinking I should ask everyone this question: I have noticed for years that upon installation of MySQL 5.0+, mysql.db is ...
33
votes
1answer
6k views

DBA first day in a new job - check backups and security - How? what else should be checked?

Generally when I start in a new environment, I tend to check where are the backups, when the last full was taken, when was the last restore applied and I check the security too. The way I do this is ...
33
votes
3answers
85k views

The login already has an account under a different user name

When I execute this SQL: USE ASPState GO IF NOT EXISTS(SELECT * FROM sys.sysusers WHERE NAME = 'R2Server\AAOUser') CREATE USER [R2Server\AAOUser] FOR LOGIN [R2Server\AAOUser]; GO I get the following ...
32
votes
8answers
3k views

Security implications of restoring a backup from an unknown source?

Scenario: You're handed a database backup and told to restore it to a server (that's already hosting other databases), but are given no useful information about what the backup contains or whether the ...
31
votes
6answers
37k views

SQL Server compatibility with New TLS Standards

The major browsers are moving beyond SSL3.0 and TLS1.0 . The PCI Security Council has declared an end-of-life date for these protocols to be considered sufficiently strong encryption. We need to move ...
29
votes
4answers
16k views

Why is OS authentication considered poor security for Oracle databases?

Oracle is deprecating OS authentication according to the Oracle Database Security Guide, which says Be aware that the REMOTE_OS_AUTHENT parameter was deprecated in Oracle Database 11g Release 1 ...
25
votes
8answers
12k views

Why is it a bad practice to allow everyone to use the sa login?

Even Microsoft discourages the use of SQL Server authentication mode, but our applications require it. I've read that it's a best practice to not let users use the sa login directly, instead using ...
23
votes
4answers
92k views

Grant permissions to run an SQL server job

I have a job on my MSSQL server 2005, that I want to allow any database user to run. I'm not worried about security, since the input to the job's actual work comes from a database table. Just running ...
23
votes
2answers
19k views

How do you reset the sa password?

I lost the sa password on a machine, and when I log in to the machine directly using an account in the admin group, SQL Server Management Studio will not allow me to log in using Windows ...
22
votes
6answers
9k views

SQL Server injection - how much damage in 26 chars?

I'm testing for resilience against injection attacks on an SQL Server database. All table names in the db are lower case, and the collation is case-sensitive, Latin1_General_CS_AS. The string I can ...
22
votes
8answers
18k views

Why should an application not use the sa account

My first question ever, please be gentle. I understand that the sa account enables complete control over a SQL Server and all the databases, users, permissions etc. I have an absolute belief that ...
22
votes
8answers
84k views

A query that lists all mapped users for a given login

When looking at the properties of a particular login, it's possible to see a list of users mapped to that login: I profiled SQL Server Management Studio (SSMS) and I see that SSMS connects to every ...
21
votes
5answers
12k views

Is it still best practice to avoid using the default ports for SQL Server?

Historically, it has been recommended not to use the default ports for connections to SQL Server, as part of security best practice. On a server with a single, default instance, the following ports ...
21
votes
6answers
93k views

How to get rid of ORA-28002 message the password will expire within 6 days?

I have a user getting an ORA-28002 indicating that the password will expire within six days. I ran the following: ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED; But when I try to log in ...
19
votes
2answers
62k views

Query to List Encryption Certificate for Databases

What certificate is being used to encrypt each of the databases on the instances. I can get the data using the following but how do I write the queries USE master GO -- this provides the list of ...
19
votes
1answer
42k views

How to transfer the ownership of the dbo schema in SQL Server 2012

I've accidentally given a user the ownership of the db_owner schema (using the check box in the UI as below) and now I cannot: Transfer ownership to another user Drop the user from DB (though I can ...
19
votes
1answer
49k views

Use of log_bin_trust_function_creators in MySQL

What is the use of log_bin_trust_function_creators? Also, Is the value of the parameter dynamic? Will it change if I restart my MySQL service?
18
votes
2answers
4k views

Why does SQL Injection not happen on this query inside a stored procedure?

I made the following stored procedure: ALTER PROCEDURE usp_actorBirthdays (@nameString nvarchar(100), @actorgender nvarchar(100)) AS SELECT ActorDOB, ActorName FROM tblActor WHERE ActorName LIKE '%' ...
18
votes
6answers
366 views

Securing DB passwords

Looking at the structure of most PHP/MySQL-based websites I've seen, it appears that it's not terribly difficult to discern the database password if you dig a bit, as there's invariably a setup or ...
18
votes
1answer
3k views

Choice of authentication approach for financial app on PostgreSQL

First some background. The LedgerSMB project is an open source financial accounting software project that runs on PostgreSQL. We implement a very large amount of business logic in user defined ...
18
votes
2answers
447 views

Is it more secure to go through a 3rd database to connect two databases using the same login?

We have the following setup: Multiple production database containing private data which is used by desktop software A web database for a public website which needs some data from the private ...
17
votes
3answers
39k views

Can I retrieve all database objects owned by a particular user?

We have a user who is leaving and I need to know every database object that he owns. Is there a query that will provide this information?
17
votes
2answers
9k views

Limit connection rights on SQL Server

I have an app to deploy in production that uses 'honor system' security. That is, all users connect to the DB using a SQL user/passwd credential and the app manages permissions itself. The latter part ...
16
votes
3answers
7k views

Securely generate a UNIQUEIDENTIFIER in SQL Server

I intend to be using a UNIQUEIDENTIFIER as an access key that users can use to access certain data. The key will act as a password in that sense. I need to generate multiple such identifiers as part ...
16
votes
1answer
12k views

Does sys.sql_logins.is_policy_checked mean that the policy has been checked?

When I look in sys.sql_logins, I see a column called is_policy_checked. Can I trust that my password policy has been checked for all of the logins where this column value is 1?
16
votes
1answer
40k views

What does role db_owner allow

I have been trying to troubleshoot a login that is not able to view certain tables in a SQL Server 2012 database. In doing so I find I don't quite understand what membership in the db_owner role ...
15
votes
2answers
53k views

How can I map a login to a database using T-SQL (not SSMS)

I'm writing a program that requires me to assign all permissions and everything in code. I have gotten stuck in this part: I just want to do the equivalent of clicking the little box under "Map" for ...
15
votes
4answers
1k views

How much of a security risk are published conceptual schema?

I was requesting the conceptual schemas from a government agency's information system for my research. My request has been denied on the grounds of it being a security risk. I don't really have ...
15
votes
2answers
164k views

Listing the existing SQL Server Logins and Users

I know we can check the logins and the users that are defined, using GUI in SQL Server, but am wondering how we can do this check using script. I ran the query below but it shows Principal_id which I'...
15
votes
2answers
10k views

What are reasonable privileges to grant typical users? [closed]

I find the list of privileges provided by MySQL to be a bit overwhelming. I'm not sure who should have what privileges. In my mind there are three typical users for my situation: root developer ...
15
votes
2answers
2k views

forensically deleting/updating data

I have a need to forensically remove data from oracle. If I just delete it, my understanding is the data will still actually be in the data file until that space is reused. I'm not concerned about the ...
15
votes
7answers
2k views

How to deny writes in all SQL Server databases (including new ones & restored ones)

I want to create a login that is denied the ability to write to any databases - not just databases that exist today, but any newly created databases or databases that are restored from other servers. ...
15
votes
1answer
4k views

How do I find out *why* a user has certain effective permissions?

I know that I can query effective permissions by using sys.fn_my_permissions: USE myDatabase; SELECT * FROM fn_my_permissions('dbo.myTable', 'OBJECT') entity_name | subentity_name | ...
14
votes
2answers
3k views

Does changing "sa" password require a SQL restart (in mixed mode)?

We discovered a SQL "sa" account being used in a way it should not have been, so we are changing sa passwords on all our SQL instances. (We have SQL 2005 through 2017 servers running in mixed ...
14
votes
4answers
3k views

Is it ever good practice to use a distinct database account for each user of an application?

The applications I'm used to are server based and use one database account for many users, with the application code controlling what the user can do, or single-user. Are there any successful complex ...
14
votes
3answers
47k views

How to export all the security-related information from a SQL Server database

As you guys probably know, SQL Server does not provide an out-of-the-box solution to export all the security related statements that are declared for each element in the database (both at the database ...
14
votes
3answers
2k views

Restricting users to COPY ONLY backups

I am looking to deploy log shipping in my production environment. This will mean I will have to manage backup chains which could be disrupted by people taking backups to refresh development ...
14
votes
4answers
15k views

Security and Performance implications of "View Server State"

This question points out that "View Server State" permission is required for various DMV's (dynamic management views), but I can't find anything about who you do and do not want to grant the ...
13
votes
2answers
19k views

SQL Server EXECUTE AS trouble

I'm missing something while trying to make my stored procedure use EXECUTE AS. The stored procedure is reading data from source_db, aggregates it and stores result in target_db. The sp itself is in ...
13
votes
2answers
2k views

Should I drop dbo from the database role db_owner?

I did a Vulnerability Assessment for my database today. I found VA2108 and it suggests me to ALTER ROLE [db_owner] DROP MEMBER [dbo] But it's the default setting of any SQL instance. Should I go for ...
13
votes
2answers
37k views

SQL Server : which role grants permission to execute all stored procedures?

Which database role membership grants permission to execute all existing stored procedures in SQL Server 2012? I tried adding a user to each of them and am still unable to execute a stored procedure. ...
13
votes
2answers
97k views

SQL Job step run as different sql account

I'm curious how to set up a SQL job step to be executed as a different SQL login account. It appears I need to set up a New Proxy Account which requires an existing credential. When I create a ...
13
votes
1answer
3k views

Why is PL/Python untrusted?

According to the docs: PL/Python is only available as an "untrusted" language, meaning it does not offer any way of restricting what users can do in it and is therefore named plpythonu. A trusted ...
13
votes
2answers
4k views

Security for Application Developers doing PL/SQL work in Oracle

How do you handle the lack of Schema level privileges in Oracle? Oracle’s security architecture works well for applications that only need object level privileges and it works well for DBAs that need ...
13
votes
2answers
1k views

Understanding MS SQL Server encryption and backups

So I was asking in chat about how secure SQL Server backup files are. I'm told that if an attacker has access to the .bak file unencrypted that they can have access to the data. So lets look at ...
13
votes
1answer
16k views

Access view based on table in another database without account in that other database

I created view in database1 based on tables in database2. I gave SELECT permission to a user who has access only to database1. The user can't get this view to work because he doesn't have an account ...
12
votes
3answers
2k views

Determine whether mixed mode auth is enabled without logging in?

Is it possible in SQL Server to determine whether mixed mode authentication is enabled without logging on to SQL Server?
12
votes
3answers
14k views

Linked Server Risks

I'm implementing a new feature which requires data from databases on multiple servers. I just need to union data from all these servers and sort it. The two options that come to mind are: Use linked ...

1
2 3 4 5
21