Re: SQL Default Login?

From: Dan Guzman (danguzman@nospam-earthlink.net)
Date: 11/14/02 

From: "Dan Guzman" <danguzman@nospam-earthlink.net>
Date: Thu, 14 Nov 2002 08:18:06 -0600

I don't see a security issue since the reported default login is not
used. A user needs a valid account (SQL Server login, or Windows
user/group) that has been granted access to SQL Server in order to
connect. Once connected, the user can access only those database they
have been explicitly granted access to plus those with the guest user. 

-- 
Hope this helps.
Dan Guzman
SQL Server MVP
-----------------------
SQL FAQ links (courtesy  Neil Pike):
http://www.ntfaq.com/Articles/Index.cfm?DepartmentID=800
http://www.sqlserverfaq.com
http://www.mssqlserver.com/faq
-----------------------
"Audrey Lim" <robwhitz@yahoo.com> wrote in message
news:10b5501c28bb3$9bf49720$2ae2c90a@phx.gbl...
> Hi,
>
> Would it pose a security concern if the default login is
> guest?  I mean having a guest user is as good as allowing
> annoymous access.
>
> Regards,
> Audrey
>
> >-----Original Message-----
> >The guest database user provides logins with a security
> context when
> >they haven't been explicitly granted database access.
> This is needed
> >for master and tempdb so that you don't need to grant
> every login access
> >to these shared databases.
> >
> >You can ignore the default login reported by
> xp_loginconfig.  This is
> >not related to the guest database user and is provided
> only for
> >backwards compatibility.
> >
> >-- 
> >Hope this helps.
> >
> >Dan Guzman
> >SQL Server MVP
> >
> >-----------------------
> >SQL FAQ links (courtesy  Neil Pike):
> >
> >http://www.ntfaq.com/Articles/Index.cfm?DepartmentID=800
> >http://www.sqlserverfaq.com
> >http://www.mssqlserver.com/faq
> >-----------------------
> >
> >"Audrey Lim" <robwhitz@yahoo.com> wrote in message
> >news:f90801c28b6b$4331e4a0$37ef2ecf@TKMSFTNGXA13...
> >> I executed the stored procedure 'xp_loginconfig' in the
> >> Master Database.  It shows that the default login for
> the
> >> database is guest user.  I understand that the guest
> user
> >> can be deleted and added to all databases except master
> >> and tempdb, where it must always exist.
> >>
> >> A few questions:-
> >> - What is the main purpose of guest in both master and
> >> tempdb?
> >> - Can I change the default login to another account in
> >> both master database without revoking the guest user?
> >>
> >> I would appreciate any advise on the above questions.
> >>
> >> Thanks,
> >> Audrey
> >>
> >
> >
> >.
> >

Relevant Pages

  • Re: System Administrator Implied Permissions
    ... > sa login, it assigns it the System Administrator fixed ... > Now, given this, why does SQL Server ... in each database is always a member of the public and db_owner roles. ... Other sysadmin role members have the exact same ...
    (microsoft.public.sqlserver.security)
  • Re: No db access after publishing web site
    ... GRANT UPDATE TO ... If I detach and attach this database on a different PC (according that PC ... Cannot open database "pago" requested by the login. ... Are you detaching/attaching the SQL Server Express database correctly ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: cannot login to the db after...
    ... Jasper Smith (SQL Server MVP) ... I have created a new database, "db_1", using the "sa" ... I then created a new login, "sqluser1" and gave ...
    (microsoft.public.sqlserver.security)
  • Re: Cant view merge agent properties (trying again)
    ... In the List of Actions for the Snapshot Agent History I see this repeated: ... every single database listed. ... So, just now, I went to computername\Administrator Login ID (because it's ... On the computer running SQL Server, ...
    (microsoft.public.sqlserver.replication)
  • Re: Database security design with ASP.net and form-based authentication
    ... Since you already have forms-based security, why not use a single SQL login ... for all database access? ... data entry, guest/view only, admin, report viewer. ... so I'm using SQL Server authentication. ...
    (microsoft.public.sqlserver.security)