1
vote
0answers
196 views

Hardening Windows Server 2012 r2 for production [closed]

We have some Windows Server 2012 R2 boxes which will be going into production in the next few weeks. Our security guy is telling us to harden the boxes before we do. I am just wondering what people ...
6
votes
3answers
440 views

How to protect SQL Server from Hackers

I am having an issue and could not figure out how to handle it. I have a SQL Server on a Windows 2008 R2 server. This SQL Server 2005 is being used to receive DB subscriptions from another SQL Server ...
1
vote
1answer
36 views

Protecting SQL from Profiling

We have some sensitive IPR in some Stored Procedures. We encrypt the stored procedures. However, at the point they are created, they are plain text. Is there anyway we can prevent SQL Server Profiler ...
3
votes
1answer
66 views

How to create SQL account that can only perform certain actions?

I'm used to working on contracts where someone else is responsible for the SQL database. However, I'm now working a contract where I must set up a new SQL Server, so I set up MS SQL Server 2012 ...
1
vote
2answers
159 views

My hosting provider allows me to see the names of all other databases on their servers, is this bad practice? [closed]

I've got MSSQL DB functionality set up with a hosting provider, and recently logged in for the first time. When I added the connection, it then listed (apparently) every single MSSQL database on ...
-8
votes
2answers
95 views

Is it OK to remove port 1433 from my SQL Server? [closed]

What are the consequences of removing 1433 all together ? I plan on only using RDeskTop to access my sever. Any Reason why this a bad Idea ? -Thank You
1
vote
1answer
966 views

security_error_ring_buffer_recorded in system health log - what does it mean?

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012. Today I was checking the log files located in: ...
4
votes
2answers
173 views

Is it possible to exploit a sql injection vulnerability with a select only permission, if I knew admin credentials? [closed]

A friend pointed out a sql injection vulnerability one an application I work with. This search parameter: '; exec xp_cmdshell 'dir'; -- Returned the message: The EXECUTE permission was denied ...
2
votes
1answer
91 views

Access front end SQL back end secure connection

I need to have an Access front end and SQL 2005 back end for a client. I would like to require them to have a static IP and I'll open a port for that IP. But they also want to be mobile, so their IP ...
0
votes
1answer
574 views

SQL Server NETWORK SERVICE account permissions

My SQL Server Windows service is set to use the NETWORK SERVICE account. The server is installed to C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL. However looking at the ...
0
votes
2answers
49 views

Safely Execute Stored Procedure Via DMZ Server

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a ...
1
vote
1answer
318 views

Security issues/risks connecting from IIS7.5 to SQL Server 2008+ using Machine Account (DOMAIN\MACHINENAME$)

I'm working with a group of engineers doing .NET 4 / MVC 3 development, using Windows 7 Enterprise and IIS 7.5 locally, and connecting to MSSQL 2008+ dev/testing databases. The databases are remote ...
3
votes
2answers
311 views

Preventing users from deleting SQL data

We just purchased a program that requires the users to have an account in the MS SQL server, with read/write access to the program's database. My concern is that since these users will now have write ...
2
votes
2answers
86 views

SQL Server EE: Restricting access to users logging in through the Microsoft server management tool [closed]

We have a database in SQL server express edition which is used by a third party application for storing data. When the users login to through this third party program their windows authentication is ...
5
votes
1answer
677 views

MSSQL 2008 R2 server roles: do server roles have implicit privileges over *all databases*?

I'm setting up a continuous integration solution involving .NET solutions and MSSQL 2008 Databases. All my build servers sit in an AD security group called Build Servers. I've created the ...
1
vote
2answers
402 views

Distributing SQL Server on Internet regarding security issue

We are going to put our servers in two places to keep high level redundancy and to avoid bandwidth critics. The two servers are on different LANs but communicate over a WAN network (via Internet). One ...
5
votes
2answers
5k views

How to allow the local Administrator to have access to SQL Server?

One of our clients has an installation of SQL Server Express 2008 R2 that we more or less manage for them. Today I need to create a new database(a fairly rare occurrence). So I go to login as the user ...
4
votes
3answers
698 views

How to create a minimum-privilege user for SQL server?

The installation documentation says best practice is to create a minimum-privilege account for the SQL Engine service to run as. What is the recommended practice on Windows to create such an ...
2
votes
2answers
251 views

Is it considered a bad idea to have a publicly facing MySQL or SQLServer Database?

If I wanted to create a publicly facing database for purposes of connecting it to a client MS Word or Open Office Writer installation, would this be considered a dangerous security practice? What if ...
0
votes
2answers
847 views

Encrypting an ODBC connection

Situation: We have a SQL Server 2008 R2 database sitting in a data centre We would like to allow analysts to connect to the database and query the data using desktop based tools (e.g. Tableau) via ...
0
votes
2answers
337 views

Configure user login and stored procedures permissions on SQL Server

I'm a software developer finishing a web application. The app uses the database "DB1" in my SQL Server 2008 "SQLServer_1". I would like to create a limited user that the web app will use in its ...
1
vote
1answer
159 views

Can I set MSSQL permissions for individual users with a group login?

I have a lot of SQL 2005 servers with a lot of databases and a lot of Windows users that need access to all the servers but only a few databases, and that last part changes regularly. Managing these ...
0
votes
2answers
154 views

Hide SQL Server 2008 from attackers

I am using an MS-SQL Server 2008 instance as back-end DB server for a project. I did some security tests on the machine hosting my project and SQL Server and got the following report on SQL Server: ...
9
votes
2answers
3k views

How to Protect Sensitive (HIPAA) SQL Server Standard Data and Log Files

I am dealing with electronic protected health information (ePHI or PHI) and HIPAA regulations require that only authorized users can access ePHI. Column-level encryption may be of value for some of ...
0
votes
4answers
81 views

How can I restore a database such that I can use it on a server where I don't have the security admin role

On a SQL 2008 instance, I have a login with the dbcreator and public roles. When I restore a database onto this server, I am then unable to use that database because all the user -> login mappings in ...
0
votes
5answers
200 views

Have opened a port. Is my server vulnerable?

I have two dedicated servers. One which stores all the files (scripting) and the other hosts just the db. In order to connect to the other server I have enabled port 2335 on TCP/IP and added the ...
2
votes
4answers
2k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
0
votes
1answer
34 views

database file storing security issue

One of clients of company i work in decided he wants to store files inside SQL (most probably mySQL) database. As far as i know it is possible, just by storing binary or contains of file inside. But ...
1
vote
3answers
767 views

MSSQL Mirroring Failover: Login failed for user

When MSSQL DB Mirroring fails over, our script won't login, fails on: Cannot open database requested by the login. The login failed. Login failed for user ... The way I can fix this is by running: ...
0
votes
1answer
115 views

Block SQL 2008 R2 Insert Access on anything for user in MS ACCESS on AD Group

Hi I would like to block access to insert any data on SQL when a User from a determined Active Directory Group access SQL from MS ACCESS. Is this possible? if not is there any alternative? I've ...
1
vote
2answers
1k views

When to use an MS SQL instance vs. different database on same instance

We have some MS SQL servers that are setup with different instances on the same server to separate applciation DB's as well as some servers that are setup with all DB's on the same instance, just ...
3
votes
4answers
446 views

Best practices for SQL Server audit trail

I'm facing a situation today where it would be very beneficial to me and my company if we knew who had logged into SQL and performed some deletions. We have a situation where at least 2 (sometimes 3) ...
1
vote
1answer
55 views

SQL server security

Is there a way to lock login process for account after 5 unsuccessful logins? Or maybe slow it down to 20 second gap until another login? I can see lots of tries to connect to my MS SQL server ...
0
votes
1answer
1k views

SSAS Roles - Creating a Role to restrict access to the cube, by country

I'm trying to create a role, to restrict access to a cube on Analysis services, so that a member of this role can only see records related to a specific country (from a dim_country dimension). So, for ...
0
votes
1answer
704 views

Report Server: login failed to master database

I noticed from the SQL Server log that every time server restarts (I'm using SQL Server 2008 developer edition) I get an error message into log: Login failed for user 'machine\sqlaccount'. Reason: ...
4
votes
3answers
1k views

Does the password get sent in the clear when connecting to Sql-Server?

I was asked this today and I honestly did not know the answer. If you connect using a connection string without sspi to a server is there any way a 3rd party can intercept on the wire the password ...
1
vote
1answer
103 views

Secure remote SQL Server connections

I have a question. We develop client-server software using SQL Server on our clients networks. We are wanting to create a web portal that links into this SQL Server database but are unaware of the ...
2
votes
2answers
613 views

Database/Web Server and SQL Server Setup - Security?

This seems really basic, but I couldn't find an answer already ... we are looking to deploy a website to an IIS server, and a database to a separate server. We aren't sure how to best secure this for ...
2
votes
4answers
778 views

Is allowing remote Sql Server Management Studio safe?

I administer a website that runs on IIS on one box, and SQL Server 2008 Workgroup on another box. typically I remote into the DB box and run SSMS to work on the db, but I would like to be able to ...
1
vote
3answers
7k views

How do I grant a database role execute permissions on a schema? What am I doing wrong?

I am using SQL Server 2008 Express edition. I have created a Login , User, Role and Schema. I have mapped the user to the login, and assigned the role to the user. The schema contains a number of ...
2
votes
3answers
3k views

SQL Server 2008 default schema not being respected?

We just copied a SQL 2008 database over to another server, for testing purposes. The typical user that logs in uses some objects in a certain schema. Let's say it's user foo and schema bar. foo's ...
2
votes
2answers
92 views

Sql Server Limiting Access

I am not sure if what I want is possible but here we go. At work we have a dedicated SQL Server 2008 box that host the various databases that we need to run. We have a remote person (lets' call them ...
0
votes
1answer
139 views

SQL Agent account vs. Proxy account

I have understood that if a job needs to access OS resources, it is recommended to create a SQL Server credential and proxy instead of using Agent account. Am I right? Why?
0
votes
2answers
105 views

Securing MSSQL between two servers

I know MSSQL can have various login modes, windows only, windows + sql, etc. named pipes, tcp/ip. Really I'm not sure what we should use. We have two servers each with IIS + MSSQL, network load ...
0
votes
2answers
282 views

How do I configure my Reporting Services User correctly?

I set up a user on our staging server for the reporting services to use for its required tasks. Or at least I thought I did. I made a couple of grave errors: I did not exempt it from the password ...
1
vote
1answer
200 views

Access from public website to private sql server database

We run a public website and need to populate a number of pages from our private databases. We don't want to push the data from our local sql server to the website's sql server as that will lead to ...
0
votes
1answer
58 views

Implementing dual control SQL updates in SQL Server

Is there any built in feature in SQL server that allows dual control updates, deletes and inserts? What I mean by dual control is that it requires any two users to collude in order to alter the ...
0
votes
3answers
445 views

Database security guidelines and tips

I have been recently hired by an event-planning company to create a web application that will allow online payment for specific events and keep a list of registrants. My employers are asking for a ...
0
votes
1answer
140 views

MS Access Security Issue (WRITE Access on a Trusted Connection?!!!)

Not sure if this is the right place for this question (Perhaps SuperUser), but I'm sure there are some Access gurus here on ServerFault. Anyway, we support some legacy MS Access apps and recently a ...
1
vote
6answers
964 views

Enabling xp_cmdshell in a production environment

A SQL developer on a project I am working on has asked whether it would be possible to enable xp_cmdshell on the production database as it is easier to export CSV files using xp_cmdshell than to write ...