Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 11 years ago.
Improve this question
SSMS (SQL Server Management Studio) has saved 3 login information on my computer. However, when I tell it to remeber the 4th login info, it simply won't remember anything next time.
This means that each and every time I want to connect using that Login, I should provide user name and password, and this really sucks.
Do you know how can we manage saved login information of the login Dialog?
I filed a bug about this issue, that we can't manage that MRU list:
SSMS : Expose "Connect to Server" MRU list to users
They've fixed the issue where you had to either deal with the list you have or purge the entire thing by deleting mru.dat or SqlStudio.bin. But they haven't really made the list any more manageable. I've asked the author of a popular free add-in about extending his tool to support this functionality and he's potentially going to look into it.
In the meantime, if you really want to have many (most complain about the opposite, too many redundant entries in the list), you should just create four different registered servers, and connect to them from the Registered Servers node in Management Studio. This is much easier than trying to identify which 127.0.0.1 credentials you want to connect to - much easier to name your registered servers 127.0.0.1/login-name for much quicker recognition.
If you want to be able to identify a server and login by server name alone, then maybe you could add entries to your hosts files that all point to 127.0.0.1, but look like 'local.login1' and 'local.login2'... you should be able to save each of these connection entries separately because Management Studio will treat them all as different servers, even if they ultimately point to the same instance of SQL Server.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I hope this question is not too broad. I am still doing research, but I was hoping to get opinions from some experts. We are a software provider and our flagship software is accessed through a portal - our SQL servers (active-active-passive cluster) are safely nestled behind our firewalls and only accessed via our application. We have a very large client looking to do an offshoot and wants direct read-only access to their database. This is something we have not done before and makes us nervous. I am hoping for some guidelines to securing SQL server for the internet.
I should say that our cluster contains hundreds of client databases, only one of which will be accessed through this internet connection. We are open to adding additional hardware or software layers if necessary. This is SQL 2005.
Thanks all.
Basically you need to get a VPN established between your site and their's. That way you can hook them up to your local network.
The VPN you use should be capable of allowing you to expose access only to the database server itself.
Once you have that, then make sure you setup a specific database user that only has rights to the actual database they need.
If VPN is not an option most firewalls will allow you to setup a policy to a specific inbound ip on a specific port where the remote client static ip has to be in the ip exception list. this way the remote client would only have access to that specific SQL instance. You would then need to create a SQL user only under the "public" server role. then you would need to go user mapping and give that user access to their database only and give them "db_denydatawriter" and "db_datareader" you would probably also want to take away access from listing other databases so that they don't know who your clients are if you use descriptive names for your clients databases. that can be done under securables under securables. you would have to click search and select "this server" The "permision" us called "view any database". of course you would need SQL authentication for this to work. keep in mind that a client that is not experienced in SQL performance could lock tables, indexes, etc... with poor queries. a list of sprocs written by your shop might be the way to go.
here is an example to get you started.
USE [master]
GO
CREATE LOGIN [remoteuser] WITH PASSWORD=N'test', DEFAULT_DATABASE=[CLIENTDB], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO
USE [CLIENTDB]
GO
CREATE USER [remoteuser] FOR LOGIN [remoteuser]
GO
USE [CLIENTDB]
GO
EXEC sp_addrolemember N'db_datareader', N'remoteuser'
GO
USE [CLIENTDB]
GO
EXEC sp_addrolemember N'db_denydatawriter', N'remoteuser'
GO
use [master]
GO
DENY VIEW ANY DATABASE TO [remoteuser]
GO
Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 8 years ago.
Improve this question
I am trying to create a log in page for my application. Since there are multiple users, my page will have the ability to store user names and password. I am using VS2012, being that I am new to programming, I am not sure if using Access or SQL Server. If I create the database to store the log in info, when I compile the program how would that affect the user who installs the program. Would the database "go with the program" when compiled?
I can also use Access to store the data, but I have the a similar issue. If the user's computer does not have Access installed on their PC, how would the table be accessed?
This is probably an entry level question, I have done some research on this but have not found much information.
If you store the login information in a Sql Server Database then you need to install the SqlServer on the customer PC and distribute your database file with your application. It is not an easy task to do in a setup project and probably this is a possible motive for Microsoft to develop the LocalDB version of Sql Server that is a little bit more easy to install.
In the case of Access you need to distribute the MDB file (your database) and (if you stay with the 2003 version) nothing else because all the required libraries are distributed together with the NET framework. In case you want to use the ACCDB file format then you need to install on the customer PC the Microsoft Access Database Engine. However in Access you could find problems with 32bit and 64bit version of the OS. It is advisable to use always the x86 as target platform.
There are also alternatives like SQLite and Sql Compact Edition.
In these days, I would use the cloud. Make your program a webapplication and use an SQL database. Then the program would be accessible in any location where there's access to an internet connection. This means that it can be used on Windows, Mac's, Linux, tablets, smartphones and even smart tv's (Not that anyone uses that).
There's good tutorials on how to do this for a webapplication from PHPacademy. See:
http://www.youtube.com/watch?v=9kyQGBABA38&list=PLE134D877783367C7
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 10 years ago.
Improve this question
I have a class called Planning and Auditing of Information Systems and I came upon a exam question that goes like this:
Why is it not recommended to use "SQL Server and Windows authentication mode" for authenticating to a Microsoft SQL database?
I searched the literature I have for this and googled it but I wasn't able to find a definitive answer for this question. Does anyone know what this question could be aiming at?
When a SQL Server instance is brought up using Mixed authentication, the "sa" logon is enabled with complete sysadmin privileges and is given a password (hopefully a very strong one). The "sa" account is a common point of attack.
A hacker with access to an instance's "sa" account not only has all the data on the compromised instance and any linked servers, he also wields the power of the service account which the instance is running under by using xp_cmdshell to call PowerShell scripts among other things. Many organizations do not follow best practices for service accounts, and they will have their entire production environment running under one or two service accounts. This makes the "sa" account a very attractive point of attack for a hacker.
Under Windows authentication, the "sa" logon is disabled. This is probably what your exam question is looking for.
Mike Walston's points are also very true.
This is just my opinion, of course, but the reason it isn't recommended is that you end up having 2 different sets of users that have to be maintained and monitored at all times. In the real world this usually ends up with one of those two groups being neglected or not properly maintained, oftentimes because the sysadmins maintain the Windows Auth users and the DBAs maintain the SQL Server users. This inconsistency can lead to security concerns, or issues where users end up with both a Windows Auth username/password and a SQL Server username/password. When deactivating users sometimes only one of the two accounts will get deactivated, leading to a possible security issue.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 10 years ago.
Improve this question
I'm using the SQL server 2008.
The scenario is:
We have about two hundred reports to generate daily, and it need plenty of time to query in DB and refine the data. We hope the reports can be sent from e-mail and saved at the windows file system at the same time. So the method need two different subscription for the two ways of delivery is not acceptable.
Wondering if we can make it by customizing the subscription directly or write some dll to enhance it(like allow us selecting a new customized delivery when edit the subscription). Could u pls give me some ideas on it? If not, we have to write a new program to do it..but it needs effort..
One option would be to cache the reports so that they run quickly the second time.
Another option would be to put the files in a Windows file share and use SSIS SendMail to pick up the files and email them out.
One more option is to write your own report runner that runs the reports and deals with them as you want. I was unsatified with the Reporting Services scheduler options and did it this way. It isn't as hard as you might think and Microsoft has some code that will get you started.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I'm working on a large SQL Server database with no documentation. Is there a good, preferably free, documentation generator tool I can use to get my head around it.
One tool that I'm using more and more to do this sort of thing is LinqPad (www.linqpad.net). This is far more than just a Linq tool. It is very good at allowing you to drill down through table relationships, as long as FK's are properly in place. This tool is free.
On the non-free side, we also use Red-Gates SQL Doc (http://www.red-gate.com/products/sql-development/sql-doc/). Excellent tool.
You might want to have a look at my new (non-free, sorry) tool - LiveDoco - it's a web app that can be installed on an intranet IIS or even on a local IIS server and then you can just use your favorite browser to connect to a SQL Server database and see its structure/metadata, edit object descriptions or even search in DB object names (tables, columns, functions and their parameters etc.) and in the extended properties where the descriptions are usually stored (under “MS_Description”). And finally there is an export feature you can use to export all extended properties to a SQL file that you can run on a different DB of the same/similar structure to import/update your descriptions/notes there.
There is a fully functional (but read-only) online demo at http://www.livedoco.com.
This link will take you directly to the Person.Contact.ContactID column in the AdventureWorks sample DB from MS: http://demo.livedoco.com/livedoco/Explorer?Server=(local)%5Csql2k8xpress&Database=AdventureWorks#/?L0Name=Person&L1Name=Contact&L2Name=COLUMN_ContactID