Re: How to restrict evil create scripts?

I would consider using Virtual Server isolation.

Set up a virtual server, save copies of the vhd/vmc files (set the file
properties to read only), and then each time you have such a script, use a
virtualized environment and 'evil' scripts won't have anything to sniff
around it.

When finished, just delete the VM.

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"Ward Bekker" <ward@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:eb7es3$c9a$1@xxxxxxxxxxxxxxxxxx
Hi,

For a service I'm working on I need to ask the user for their database
create script. It's used to re-create the users database schema in a
temporary database on a in-house server in an automated fashion.

For security reasons, I need to be sure that the create script can only
create tables, columns etc and not things like snooping in other databases
and/or formatting the server.

Can you give me pointers about what the minimum grants are to let good
script execute successfully and evil scripts fail?

Regards,

Ward


--
Ward Bekker
"Asp.Net Discussions for the Professional Developer"
http://www.dotnettaxi.com

"Free .Net 2.0 C# to/from VB.Net Code Converter"
http://www.dotnettaxi.com/Tools/Converter.aspx


.

Relevant Pages

  • Re: How to restrict evil create scripts?
    ... SQL Server can have advanced security configuration, so I was wondering what could be done in that level. ... Set up a virtual server, save copies of the vhd/vmc files, and then each time you have such a script, use a virtualized environment and 'evil' scripts won't have anything to sniff around it. ...
    (microsoft.public.sqlserver.security)
  • Problem creating new portal i SPS 2003
    ... 10:55:12 Starting portal creation for 'test only'. ... 10:55:12 Service database server is 'MyServer'. ... 10:55:12 Opening virtual server. ... 10:56:58 cmd.CommandText set as: Update dbo.propertylist set DisplayName = ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Get custom database properties from an Access database
    ... It doesn't matter if the VBScript process drags, since it is an independent process and so will have no effect on the user's interaction with the database. ... The user can skip merrily along, doing whatever he needs while the script invisibly figures out the current situation in the background and decides what to do about it. ... It does, but I've run into issues other places on this same network, where users needed a drive letter to a server. ...
    (microsoft.public.scripting.vbscript)
  • Portal creation failed at 52%
    ... 09:45:34 Service database server is 'CCTLBSRV-TEST\SHAREPOINTPORTAL'. ... 09:45:34 Opening virtual server. ... PropertyName='FirstName' Update dbo.propertylist set DisplayName = ...
    (microsoft.public.sharepoint.portalserver.development)
  • Portal creation failed at 52%
    ... 09:45:34 Service database server is 'CCTLBSRV-TEST\SHAREPOINTPORTAL'. ... 09:45:34 Opening virtual server. ... PropertyName='FirstName' Update dbo.propertylist set DisplayName = ...
    (microsoft.public.sharepoint.portalserver)