Solved

SQL Server 2000: Are the permisions for the public role important?

Posted on 2008-06-23
3
323 Views
Last Modified: 2010-04-21
Hi Experts,

in regards to the SQL Injection Hack the past weeks, we take a look on the permissions in our SQL Server and seen the permisions for the public role. There are many select or exec permissions given, mostly system tables and some standard SP.

We wonder if these permissions are important. We put them off and our Websites and other Apps seems still working. Are there some permissions we should let open?

Regards,
Christophe
0
Comment
Question by:meishu
3 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 250 total points
ID: 21845293
Well...it depends.  These would be permissions given to every user in the db who can connect...so, it is likely reasonably important.  It becomes even more important if you're dealing with sensitive data or have given public permission to run xp_cmdshell.  If you've taken the perms away and all is still well, then keep it that way.  If you have taken them away and start getting problems, investigate the exact permissions needed and give them to an account other than public.
0
 
LVL 5

Expert Comment

by:kumar_jac
ID: 21845846
Hi,
 Regarding Sql Injection Attack,
If you do data manipilation only by SPs do this
Create a new user and Revoke permissions to all tables.
Only give the permission to SPs you want to execute.
If you have 2 set of SPs for user and Admin grant only access to User SPs

If the user have permission to execute the SP no need of permission to execute tables.
So If hacker use the table name also that won't affect.

If he pass some dynamic query to SP also that will fail

Thanks

Krishna
0
 

Author Closing Comment

by:meishu
ID: 31469699
Thx for the quick Answer. I was hopping to get more details, but I will handle it that way.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
Ever needed a SQL 2008 Database replicated/mirrored/log shipped on another server but you can't take the downtime inflicted by initial snapshot or disconnect while T-logs are restored or mirror applied? You can use SQL Server Initialize from Backup…
Viewers will learn how to use the SELECT statement in SQL to return specific rows and columns, with various degrees of sorting and limits in place.
Viewers will learn how to use the SELECT statement in SQL and will be exposed to the many uses the SELECT statement has.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now