Re: major security concern - any sql user with minimal permission can see code for all stored procs and triggers

From: Richard Waymire [MS] (rwaymi_ms@microsoft.com)
Date: 05/17/02 

From: "Richard Waymire [MS]" <rwaymi_ms@microsoft.com>
Date: Fri, 17 May 2002 11:56:30 -0700

no, you're not missing anything. Current design is that if you are a user
(with any permissions at all) in a database then you can see all the
metadata in the database. No supported way to change this. 

--
Richard Waymire, MCSE, MCDBA
This posting is provided "AS IS" with no warranties, and confers no rights.
"Pankul Verma" <pankul@urbanwireless.com> wrote in message
news:OQsnJ#D$BHA.2200@tkmsftngp02...
> I created a SQL authenticated login to my sqlserver for a business partner
> who needed to execute an SP on my server at his location. gave him
> permission only on 1 SP (no tables etc)
>
> before rolling out, I did my homework,
> connected from a remote location to my SQL server at port 1433, and the
> application worked
>
> now I used Enterprise Manager to add the SQL Server from my remote
location,
> which gave me the access to view each and every Stored Proc, trigger,
table
> DRI etc ...
> infact i was able to Script my entire database using this.
>
> same results from query analyser ...
>
> obviously I cud'nt select data from tables or execute SPs that i did not
> have access to, however ... this raises a big concern of security for me,
if
> a guy can see all the source code, its not nice!
>
> Am I missing somehting?
>
> Pankul
>
>
>

Relevant Pages

  • ADP, Application Role, and objects
    ... The above link is to an atricle on how to implement SQL Server Application ... After you connect with your ADP, fire a bit of code to set the ... third party tools to view the data on the same database. ... Scenario 1 - If I explicitly grant permissions on that object to the user ...
    (microsoft.public.access.adp.sqlserver)
  • Re: Execute Persmission denied on object sp_OACreate
    ... > SQL Server is creating a job behind the scenes. ... > permissions. ... > SA account password and gaining access to the database. ... >>> How can get a user permissions to execute these stored procedures ...
    (microsoft.public.sqlserver.security)
  • Re: Newbie: I dont understand user permissions for table access
    ... > My database is remote to my workstation. ... > tables/fields WITHOUT specifying anything in the permissions dialogs? ... >> HOW are you connecting to SQL Server? ... what rights/permissions have been granted to the PUBLIC role? ...
    (microsoft.public.sqlserver.server)
  • Re: Execute Persmission denied on object sp_OACreate
    ... SQL Server is creating a job behind the scenes. ... SA account password and gaining access to the database. ... > SQL Server doesn't check permissions on indirectly referenced objects as ... > the proxy account security context for non-sysadmin users from Enterprise ...
    (microsoft.public.sqlserver.security)
  • Re: Security question ..
    ... What I want to prevent is any access to the database accept through our ... application unless you have elevated permissions. ... Authentication, if he is smart enough to create an NT Auth ODBC connection ... passes through to the database or to use SQL Server authentication. ...
    (microsoft.public.sqlserver.server)
Quantcast