MS SQL Server with encrypted password - sql-server

I am trying to create a table in SQL Server
create table admin (name varchar(40), pass varchar(40))
The problem is I don't want password to be visible I mean it should be shown like **** as usual in log in systems.
Waiting to hear from you soon.

Related

Data is not visible on remote Oracle 18 XE connection

I have created Oracle Database on windows machine , with test table.
CREATE TABLE TESTUSER ( NAME VARCHAR2(20) , LASTNAME VARCHAR2(20) );
and inserted data into this table
insert into testuser(name, lastname) VALUES('Jon','Doe');
Then remote connected to this database from another machine, connected and authenticated successfully, I can see table and columns, but when I query the table, it is empty.
Have anyone faced similar issue? will much appreciate the hint or correct direction.

Azure SQL database is not designed to allow users change their passwords. Any workaround?

We start with the facts:
Logins are in the master database,
users are in a user database.
Azure does not allow to change database with USE statement.
SQL requires the user to be in the master database in order to execute ALTER LOGIN statement.
.
--USE master;
--**ERROR** USE statement is not supported to switch between databases. Use a new connection to connect to a different database.
--GO
ALTER LOGIN nonadmin WITH PASSWORD='new5as$word' OLD_PASSWORD='old5a$sword';
--**ERROR** User must be in the master database.
GO
It is possible to migrate the database to contained mode, but this way would be quite exhausting as the legacy code have plenty of places like this:
IF(OBJECT_ID('tempdb..#temp1') IS NOT NULL)
BEGIN
DROP TABLE #temp1
END;
CREATE TABLE #temp1
(
id int not null IDENTITY,
CONSTRAINT PK_tt1 PRIMARY KEY(id)
)
Is there a suitable workaround except migrating to contained database mode?
You are trying to change the password of a contained user. Contained users don't have server logins so you can't use the ALTER LOGIN statement.
You need to use ALTER USER :
ALTER USER nonadmin WITH PASSWORD='new5as$word' OLD_PASSWORD='old5a$sword';
A server login is the identity with which you login to a server. In SSMS, you'll find logins in a server's Security node. These logins are then granted access to specific databases as users. These users are stored in the master database.
elect the Database choice on the left, then select Servers:
Then, after selecting the server of choice, you'll see the option on the right for resetting admin password:
source : Password reset for Azure database

Default schema for DROP and SELECT INTO in stored procedures

I am a bit confused as to how the default database schema is determined in MS SQL server.
I have the following stored procedure as a minimal working example:
CREATE PROCEDURE [dbo].[SampleSP]
AS
SELECT 'HI' as [SampleColumn]
INTO [SampleTable]
DROP TABLE [SampleTable]
All tests are executed using a user User on MS SQL server using Windows Auth with a default database schema of the same name.
When I execute this SP on MS SQL Server 2005 installation (running in compatibility mode 80, i.e. Server 2000) the table is created as [User].[SampleTable] and DROP TABLE fails with Invalid object name 'SampleTable' (I assume because it looks for [dbo].[SampleTable])
When I DROP TABLE [SampleTable] in a separate query it does work
When I execute the SP on MS SQL Server 2008 R2 (also running in compat. 80) the table is created as [dbo].[SampleTable] and dropped without error
I have found this answer describing the lookup in stored procedures, but it doesn't mention the user default in that context, even though it is used on 2005. Maybe someone knows how this changed and whether new versions can be configured to behave the same way.
It sounds like you just need to set the default schema for the user to dbo:
ALTER USER YourUser WITH DEFAULT_SCHEMA = dbo;
That way it's set at the user level and you won't need to alter any code.

SQL Server 2005 Encryption

I am developing an intranet application that contains a few connection strings in a database table with passwords (the previous developer did this - I know it is bad practice). The plan was to upgrade from SQL Server 2005 to SQL Server 2008, so I was going to wait for this and then use TDE (Transparent Data Encryption) as no changes are required to code even when the data is encrypted.
I have now discovered that we are not upgrading to SQL Server 2008. What other options do I have to minimise changes required to the application? I thought of using the encryption facility in the web.config but I believe a lot of changes will be required. What other options do I have? There are two client applications that connect to it i.e. VB6 and VB.NT.
I can think of three options that you can take. First is to have your system administrator provision a service account from active directory, grant the same permissions as the sql account, then configure the Application Identity property in the advanced settings of the application pool in IIS. You will then be able to remove the username and password from the configuration string and replace it with the property "trusted_connection=true".
Second, you can apply column level encryption to encrypt the connection strings stored in your database. It can be done without any code changes for your intranet app. You will need to rename the table, create a view with the old table name containing the function decryptautokeybycert. I'll post an example at the end of the post.
Third, you can have the DBA configure the server to force all connections to be encrypted using SSL\TLS.
use master
go
create database EncryptedData
go
use EncryptedData
create master key encryption by password='P#ssw0rd!'
create certificate KeyProtection with subject='Key Protection'
create symmetric key ColumnKey
with algorithm=AES_256
encryption by certificate KeyProtection
create table SecretMessages(Ciphertext varbinary(4000))
go
create view dbo.MessageRecords
as
select
cast(DECRYPTBYKEYAUTOCERT( cert_id('KeyProtection'), null,Ciphertext) as varchar(max)) MessageRecord
from dbo.SecretMessages
go
open symmetric key ColumnKey decryption by certificate KeyProtection
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 1'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 2'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 3'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 4'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 5'))
close symmetric key ColumnKey
select * from MessageRecords

How do I log what user deleted a record in MS Access?

It's a MS Access app with linked tables to SQL Server. I need to log this on the SQL Server as I cannot modify the MS Access app.
The app connects to the SQL Server through a default SQL username.
You will need a trigger for this, and a table to store the results. Very quick prototype:
CREATE TRIGGER dbo.trigger_name
ON dbo.table_name
FOR DELETE
AS
INSERT INTO dbo.LogTable(RowID, UserName)
SELECT PK_Column, SUSER_SNAME()
FROM deleted;
GO
Note that unless each Access user authenticates to SQL Server as themselves, you may need to use host name or some other property to identify them (if they all connect as the same SQL user, there is little SQL Server can do to determine who they really are).

Resources