DB_Owner Database Role Membership Permission in SQL 2005
-
We are using a VB6 application thru Citrix Metaframe 4 on Windows 2003
Servers that accesses a database on an SQL 2005 server (Windows Server
2003 OS) that requires that the users (or user group) have the
DB_Owner Database Role Membership Permission in SQL 2005. A client is
concerned that this level of access for their users will leave open
potential security risks. When we remove the DB_Owner Database Role
Membership Permission in SQL 2005 our VB6 application cannot properly
run stored procedures among other tasks. We use windows integrated
security (active directory) only setup and NOT SQL Server
authentication.
Is the DB_Owner Database Role Membership Permission in SQL 2005 a real
risk for security? The client is concerned the users can hack in and
drop or alter the databases.
Thank you!
-
It is a risk to give db_owner permissions to a user. check this link: http://technet.microsoft.com/en-us/library/cc966507.aspx.
-
It is a risk if you have someone that wants to be milicious, he can steel information or remove important data that will cost you time and man hours to fix. There is another way to protect the system and you can do it with server triggers. This will allow you to grant db_owner rights to users that log in from the app and deny access if they log in with anything else.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Do not reinvent the wheel.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply