1. Copyright © 2013 – 2018 by Curt Hill
SQL Security Commands
Emphasis on SQLServer
Copyright © 2013 – 2018 by Curt Hill

2. Copyright © 2013 – 2018 by Curt Hill
SQL Server
SQL Server may use either discretionary or role based or combination of the two
Each role expresses the relationship a login has to objects
Determines what the user may do
The notion of a role is to ease the management of permissions
These permissions may be given or taken away from individuals or to every user who has the same role
Copyright © 2013 – 2018 by Curt Hill

3. Copyright © 2013 – 2018 by Curt Hill
Role types
SQLServer has:
Predefined roles connected to a particular database
Fixed roles connected to entire server
User created roles which are connected to a particular database
A few of these are considered in the next screens
Copyright © 2013 – 2018 by Curt Hill

4. Copyright © 2013 – 2018 by Curt Hill
Predefined roles
db_owner: Members have full access
db_datareader: Members can read all data
db_datawriter: Members can add, delete, or modify data in the tables
db_securityadmin: Members can modify role membership and manage permissions
db_bckupoperator: Members can back up the database
Copyright © 2013 – 2018 by Curt Hill

5. Copyright © 2013 – 2018 by Curt Hill
Fixed roles
SysAdmin: Any member can perform any action on the server
ServerAdmin: Any member can set configuration options on the server
Security Admin: Any member can manage server security
DbCreator: Any member can create, alter, drop, and restore databases.
BulkAdmin: Any member can run the bulk insert command
Copyright © 2013 – 2018 by Curt Hill

6. Copyright © 2013 – 2018 by Curt Hill
Assigning Roles
Like many things in SQL Server things can be done by the Management Console or by SQL command
Many of the SQL commands in this area have a unique syntax for SQL Server
The SQL command is Create Role
Copyright © 2013 – 2018 by Curt Hill

7. Copyright © 2013 – 2018 by Curt Hill
Creating a role
Syntax is: Create Role role_name Authorization user
The role_name is the new role
User is the user which owns this role
This may be left out (including Authorization) then the current user owns this role
This type of role is then connected with database objects
Copyright © 2013 – 2018 by Curt Hill

8. Copyright © 2013 – 2018 by Curt Hill
Now what?
Once roles are created we may give them permissions
The reserved word is Grant
With Grant we connect a permission with a user or role
Consider the syntax next
Copyright © 2013 – 2018 by Curt Hill

9. Simplified Grant Syntax
GRANT permission [ ( column [ ,...n ] ) ] [ ,...n ] [ ON securable ] TO principal [ ,...n ] [ WITH GRANT OPTION ] [ AS principal ]
Where
Permission is what they are able to do
Securable may be a table, database, stored procedure among others
Principal is a login or role
Copyright © 2013 – 2018 by Curt Hill

10. Copyright © 2013 – 2018 by Curt Hill
Permissions
The permissions depend on the object considered
For a table or view they include: DELETE, INSERT, REFERENCES, SELECT, UPDATE
For a stored procedure only EXECUTE
For a database there are many
One for most actions
Copyright © 2013 – 2018 by Curt Hill

11. Copyright © 2013 – 2018 by Curt Hill
An Example
Consider the following: Create Role TestRole Grant SELECT ON Faculty TO TestRole Grant Update ON Faculty TO TestRole
Permissions not granted are unavailable
The table may need to be qualified by the database
Copyright © 2013 – 2018 by Curt Hill

12. Copyright © 2013 – 2018 by Curt Hill
Deny
Blocks a permission
Usually used to remove a single permission
Syntax is similar to Grant
Example: Deny Update ON Faculty TO TestRole
Copyright © 2013 – 2018 by Curt Hill

13. Copyright © 2013 – 2018 by Curt Hill
Revoke
Removes the permission specified by a Grant or Deny
Similar syntax
Example Revoke Select on Faculty from TestRole
Copyright © 2013 – 2018 by Curt Hill

14. Copyright © 2013 – 2018 by Curt Hill
Oracle
Not the number 1 database without cause
Has all the capabilities of the normal database
Implements:
Create Role
Grant
Deny
Revoke
Although not quite the same syntax
Copyright © 2013 – 2018 by Curt Hill

15. Copyright © 2013 – 2018 by Curt Hill
Guidelines
Restrict permissions to those who actually need them
Common mistake is for too many users to have excessive privileges
Web access is usually through a predefined login
Secure it to prevent issues
Copyright © 2013 – 2018 by Curt Hill

16. Copyright © 2013 – 2018 by Curt Hill
Finally
The DBA ultimately is in change of permissions
One of the permissions is to grant the ability to grant permissions
The more serious the action the less likely one should grant permission to use it
Thus Drop should be seldom granted while Select frequently
Copyright © 2013 – 2018 by Curt Hill