Re: Revoking public permissions

From: Russell Fields (RussellFields_at_NoMailPlease.Com)
Date: 02/26/04

  • Next message: anonymous_at_discussions.microsoft.com: "Re: Linking Oracle DB to SQL DB" 
    Date: Thu, 26 Feb 2004 16:51:58 -0500

    Gemmill,

    We have many databases with all rights to user tables, views, stored
    procedures, etc. revoked for public. (You can do this by simply never
    granting any rights to public as well.) Also, make sure you do not have
    the guest account. (I have never tried to revoke public rights to the
    system tables, so I don't know if you can do that. I guess I can go try
    when I get back to my office.)

    The main implication is that you will break rights that your people have
    become accustomed to.

    Russell Fields

    "Gemmill" <anonymous@discussions.microsoft.com> wrote in message
    news:2657C8D7-F49D-47D1-99B6-04D470BE6D71@microsoft.com...
    > I am doing some security work on SQL server and am concerned about the
    permisions on the public role. i want to strip down the permisions given to
    the public role in the system databases. What are the implications of
    runnign scripts to revoke all to public for all statements and objects in
    all databases. I have read this causes problems? What have other folk done
    regarding this and is there a definitive list anywhere?
    >
    > Thanks in advance

  • Next message: anonymous_at_discussions.microsoft.com: "Re: Linking Oracle DB to SQL DB"

    Relevant Pages

    • Re: DTS permissions to create
      ... The way I'd do it is remove (revoke and not deny) the exec ... rights from the public role and then create your own role with exec rights ...
      (microsoft.public.sqlserver.server)
    • RE: Users on a DB are dropped without any intervention
      ... This posting is provided “AS IS” with no warranties, and confers no rights. ... For information about the Microsoft Strategic Technology ... Protection Program and to order your FREE Security Tool Kit, ... | rights in a couple of the databases that they had rights ...
      (microsoft.public.sqlserver.security)
    • RE: [Maybe spam] Re: Relation of OS user to Informix database
      ... user who has those rights because they're a member of public? ... then you can't revoke their rights without revoking public's ... > RESOURCE permissions from the informix DBA user. ... When you created the database, was a MODE ANSI database, or a logged or ...
      (comp.databases.informix)
    • RE: [Maybe spam] Re: Relation of OS user to Informix database
      ... You can only revoke a privilege that exists explicitly and you are the ... if a user's rights are part of "public" then you cannot prevent the ... >> RESOURCE permissions from the informix DBA user. ... >When you created the database, was a MODE ANSI database, or a logged or ...
      (comp.databases.informix)
    • Re: revoking all the privileges from public
      ... You don't say which version of SQL Server you are running, ... you can revoke some rights in master and msdb and still have ...
      (microsoft.public.sqlserver.clients)