?
Solved

SQL Server 2000: Are the permisions for the public role important?

Posted on 2008-06-23
3
Medium Priority
?
365 Views
Last Modified: 2010-04-21
Hi Experts,

in regards to the SQL Injection Hack the past weeks, we take a look on the permissions in our SQL Server and seen the permisions for the public role. There are many select or exec permissions given, mostly system tables and some standard SP.

We wonder if these permissions are important. We put them off and our Websites and other Apps seems still working. Are there some permissions we should let open?

Regards,
Christophe
0
Comment
Question by:meishu
3 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 750 total points
ID: 21845293
Well...it depends.  These would be permissions given to every user in the db who can connect...so, it is likely reasonably important.  It becomes even more important if you're dealing with sensitive data or have given public permission to run xp_cmdshell.  If you've taken the perms away and all is still well, then keep it that way.  If you have taken them away and start getting problems, investigate the exact permissions needed and give them to an account other than public.
0
 
LVL 5

Expert Comment

by:kumar_jac
ID: 21845846
Hi,
 Regarding Sql Injection Attack,
If you do data manipilation only by SPs do this
Create a new user and Revoke permissions to all tables.
Only give the permission to SPs you want to execute.
If you have 2 set of SPs for user and Admin grant only access to User SPs

If the user have permission to execute the SP no need of permission to execute tables.
So If hacker use the table name also that won't affect.

If he pass some dynamic query to SP also that will fail

Thanks

Krishna
0
 

Author Closing Comment

by:meishu
ID: 31469699
Thx for the quick Answer. I was hopping to get more details, but I will handle it that way.
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windocks is an independent port of Docker's open source to Windows.   This article introduces the use of SQL Server in containers, with integrated support of SQL Server database cloning.
One of the most important things in an application is the query performance. This article intends to give you good tips to improve the performance of your queries.
Familiarize people with the process of utilizing SQL Server functions from within Microsoft Access. Microsoft Access is a very powerful client/server development tool. One of the SQL Server objects that you can interact with from within Microsoft Ac…
Via a live example, show how to set up a backup for SQL Server using a Maintenance Plan and how to schedule the job into SQL Server Agent.
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question