DataBase security

From: sniper (andyrightin@yahoo.com)
Date: 02/11/03 

From: "sniper" <andyrightin@yahoo.com>
Date: Mon, 10 Feb 2003 22:09:25 -0800

sun patel bhai,
there are many ways to hack the SQL server and in turn
hack the NT server itself
i myself do that as a profession !
read the following points on www.sqlsecurity.com
read the sqlcheck list and disscussion forum there
quick points
1) dont use sa ..put a strong password and dont use the
account unless an emergency use an equivalent sysadmin
account
2) if possible change the default port 1433 to some other
port and only the application guys and the dba should
know this
3) connect using TCP/IP only ..if possible dont use named
service which use port 1434/UDP
4) be sure that ur network is secure, if ur server or
application is on the Internet then ther are more issues
read more about Slammer worm ..recently been released
which attacks the port 1433 and 1434,if not try a firewall
service.
5) mail me for any more points be brief and specific !!
chow
soumen

>-----Original Message-----
>hi,
>
>I had developed a software with sqlserver as a backhand.
>The problem i am facing is that i am unable to secure
>my database. I had very little idea abt database security.
>
>I wish that no one except system administrator could
access
>database either through Enterprise Manager or Query
>Analyzer.
>
>Awaiting a quick respone
>
>Thanking you
>rushi
>.
>

Relevant Pages

  • Re: SQL2005: Cannot connect error 11001
    ... user mapped to one database. ... Does the issue has to do with the login account / user ... Server connection. ... if you changed the port ...
    (microsoft.public.sqlserver.connect)
  • DB Fault Tolerance - network connections
    ... a Perl server which talks to a PostgreSQL database on a different phys. ... block the port on the DB server, ... Note that I'm using iptables on the box that is running the Postgresql ...
    (perl.dbi.users)
  • Re: Created on Access 2003, but.......................
    ... But that's not secure under any scenario, as any port scanner ... Well, you still need a userid, password and database name. ... You're assuming the server remains in a secured configuration. ...
    (comp.databases.ms-access)
  • Re: How to get an unix programmer started on web programming?
    ... Don't allow access to your Oracle server through the web, especially if you have confidential data on it that's not needed by the web. ... Rather, replicate only the data necessary to run your website to another database accessible by the web server. ... A well written system will not allow a user to hack your system and access arbitrary bits of data in a database nor destroy a database. ...
    (comp.lang.php)
  • Re: Created on Access 2003, but.......................
    ... fact an external connection via a server. ... port to make it available across the Internet. ... The name of the server, the port number, and the name of the database for my databse are only available to me. ... This is as secure as any external connection can be. ...
    (comp.databases.ms-access)