This question was migrated from Stack Overflow because it can be answered on Database Administrators Stack Exchange.
Migrated 2 days ago.
Is there a way to prevent deletion of Azure SQL database within SQL Server Management Studio using one account?
Of course, this is on ONE admin account.
We tried to follow this URL: https://www.sqlshack.com/protecting-azure-sql-databases-from-accidental-deletion/, but it only prevents it from the Portal?
We tried to follow this URL: protecting azure sql databases from accidental deletion, but it only prevents it from the Portal?
As per this Document,
While a delete lock on an Azure SQL database will prevent deletion operations through the Azure portal or other Azure tools,
It will not prevent a user with proper permissions on the SQL Server from deleting the database by executing a T-SQL command like "DROP DATABASE [DATABASENAME]" and through SSMS doesn't know which azure locks applied on Azure SQL database it will delete the database.
If you want to prevent users from deleting Azure SQL databases through T-SQL commands,
You can use role-based access control (RBAC) to restrict database permissions for specific users or groups.
By granting only the necessary permissions to users, you can prevent accidental or intentional deletion of important databases.
-- CONTROL permission on the database
-- Or ALTER ANY DATABASE
-- Or the db_owner role in the database.
mainly these permissions are required to delete database.
Thankfully, the server that the wiped database was on should have the ability to restore the deleted database.
Related
I'm using the Telegraf input plugin for SQL Server (https://github.com/influxdata/telegraf/tree/master/plugins/inputs/sqlserver) to gather metrics and report to InfluxDB. It works well for SQL Server, but though it supports Azure SQL Database the documentation is a bit sparse.
The database user should be created like this:
CREATE LOGIN [telegraf] WITH PASSWORD = N'password';
GRANT VIEW SERVER STATE TO [telegraf];
GRANT VIEW ANY DEFINITION TO [telegraf];
That works on SQL Server, but in Azure it fails:
Securable class 'server' not supported in this version of SQL Server.
I wonder what I need to grant instead in order to solve this in the best possible way. We have a large number of databases running on the same server in an elastic pool, so if it is possible I would like to use a single user that logs in to the master and collects metrics for all the databases at once (the way it works with SQL Server). If that is impossible I can configure multiple logins and process one database at a time.
Perhaps I can grant VIEW DEFINITION at the database level, but VIEW SERVER STATE does not seem to be supported at all.
So, how should I configure the SQL Database login(s) for Telegraf with the SQL Server plugin to make it work?
EDIT:
Running as the super user for the server works without errors, but only produces metrics for master and tempdb. I need metrics for the many application databases and they are missing. Plus running as the super user is less than ideal.
Running as the super user for the server but connecting to a specific application database (add database in connection string) crashes with a nil pointer dereference and the log complains about VIEW DATABASE STATE permission denied in database master (the super user has access, but apparently not when connecting to a spefic database).
Granting VIEW DATABASE and VIEW DEFINITION to telegraf in an application database and connecting directly to that database as telegraf crashes with a nil pointer dereference and the log says the connection was closed.
EDIT 2:
Created bug report https://github.com/influxdata/telegraf/issues/4222.
EDIT 3:
As of the latest release the plugin works if the server admin account is used, so the issue has been solved. There is still no way to run with a less privileged account in Azure DB.
The answer:
GRANT VIEW SERVER STATE is not supported in Azure SQL Database.
On SQL Database Premium Tiers requires the VIEW DATABASE STATE
permission in the database. Permissions can not be granted in Master,
but the views can be queried in user databases. On SQL Database
Standard and Basic Tiers requires the SQL Database server admin
account due to security requirements following from multi tenancy of
those tiers.
Reason:
SQL Azure SQL is PaaS solution, therefore the most "server" specific features, DMVs, settings are blocked by purpose
References:
Grant View Server State - is it possible for a none SA user to have in Azure SQL?
SQL Azure VIEW DATABASE STATE permission denied in database 'master'
Possible workaround: (which is, anyway does not work in ewramner case)
CREATE LOGIN [telegraf] WITH PASSWORD = N'password';
USE [yourDB]
GRANT VIEW DEFINITION TO [telegraf];
GRANT VIEW DATABASE STATE TO [telegraf];
Therefore, (IMHO), there is no way to make such application working in SQL Azure without changing application code
Trying to understand if SSMS can be configured to only query data from server tables and not alter the tables themselves. In short, can the flow of info be restricted to only one way...from the server to SQL Server Management Studio?
Your best bet is to put the users that you want only to query data in a group that has only rights to query data.
Permissions should be configured so that only the properly authorized users can alter the table schema. If your organization is currently using one database login for everything, that needs to stop. Typically, you'll have a level of read-only users, a level of read-write users, a level of read-write-execute (for stored procedures) users, and Administrative users. Trying to make the UI application restrict functions by itself won't work, as more than just Sql Server Management Studio can connect to SQL Server. Basic users should be set up as read-only. Applications should have whatever permissions group they need, though never Admin and each application should have its own specialized login.
I have a .NET application which connects to SQL Server 2008 for storing some data. I use SQL Server authenthication providing an sq username and a password to my end-user in app.config file. If something more needs to be changed I give to the end-user some other credentials.
How can I limit the sql user to only have permission to read/write data and executing existing stored procedures and everything else to be forbidden?
What is the best practice for setting permisions for a sql user that an application is using to connect to a database? Can I prevent somehow the user from logging in Management Studio and mess with my data?
I'm not searching for the perfect 100% reliable solution, but the best existing practice to do this. Thank you very much in advance.
Update: I work on a shared hosting SQL Server environment.
You'll need to create a new SQL user, something like 'LimitedUser'. To do this in SSMS, select the Security Folder of the server you are using, right-click, select New, select Login.
Select your authentication type (SQL server authentication is easily managed), and set the Default database to your database.
You'll need to set Server Roles so this new user only maps to your DB, and in the last page (Status), set Login to false so they cannot use these credentials to login to SSMS and 'mess with your data'.
Click OK, and you're done creating your limited user.
Assign it to your database, and then in SSMS, right-click on your db, select Properties, Permissions.
Select your user or role, and in the permission grid below, switch on only what need to be switched on.
As I see, your question is fully concerned with SQL server security.
You can limit user permissions on server, database or object scope, using GRANT statement, server or database roles. For example, you can assign db_datareader role for user, and then grant EXECUTE permission to this user for some stored procedures (or for entire database).
The current practice in my organization is to create the database roles (e.g. application admin, operator, and so on), adding the appropriate permissions to these roles and then assign these roles to database users.
I'm not completelly sure that you can prevent login into SQL Server Managent studio (SSMS), but SSMS wll not display information that must be invisible for user with user current permissions.
Shared SQL Server hosting where a single instance is shared among multiple customers is not compatible with with typical client-server applications. You are expected to perform all operations through a middle tier server such a WCF Data Service and maintain user accounts within your database in a table with Forms Authentication etc.
For your client-server application you need VPS hosting with your own instance of SQL server where you can create server-level logins. Without creating server-level logins there is no method to secure a client-server application. Any workarounds are just pseudo-security.
I recently installed SQL Server 2005 Management Studio Express. When I login to the Database server machinename\SQLEXPRESS using Windows Authentication.
I am unable to create tables or create databases. How do I grant the permissions for the users logged in as Windows Authentication to be able to create tables / databases?
You can make your user part of the sysadmin role
exec sp_addsrvrolemember 'DomainOrComputerName\UserName','sysadmin'
That will solve your problem but it is overkill and grants the users complete access to your database including the ability to delete your databases and technically they can do anything on your computer they want unless you have limited your SQL Server Service accounts rights. To allow the ability to create tables use
Grant Create Table to [domainName\userName] That will give them the ability to create a table in the database where you run that statement.
I want to manage permissions and access to a SQL Server database server on a development machine. I've created a local windows group (called DBReaderGroup) and assigned various people to it. The group was created as a SQL Server login successfully:
create login [MYMACHINE\DBReaderGroup] from windows
My goal is to grant this group read/write access to all databases (which are constantly being added and dropped). Is it possible to configure the right settings so that SQL Server manages this?
My biggest challenge is that each time a db is created, I have to update the "User Mapping" settings for this group on the new database.
Am I missing something simple?
Add the login to the Model database in the db_datawriter role, and any new database will give that login full write access by default. This won't work, however, if the databases being added are from other sources (ie restored versions).