"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.
It is not configurable. It is a security feature in Profiler.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.
Showing posts with label password. Show all posts
Showing posts with label password. Show all posts
Friday, March 16, 2012
"The text has been replaced with this comment for security reasons
"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.|||A security feature? I cannot believe it cannot be turned off, if it cannot I
am going back to SP3. I need to see what my stored procedures my application
is calling and the parameters passed to them. How am I supposed to do this if
the SP contains a parameter called password?
This blocking seems silly to me.
"Tibor Karaszi" wrote:
> It is not configurable. It is a security feature in Profiler.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "nickname" <nickname@.online.nospam> wrote in message
> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> > "-- 'password' was found in the text of this event.
> > -- The text has been replaced with this comment for security reasons."
> >
> > How do I turn this functionality off? I need to display the SQL statement.
>|||Did you see this post-sp3? I thought that Profiler always hides the text. Perhaps they expanded it
from sp_password to just password? Anyhow, perhaps you can find something in ReadMe for the service
pack (4, I presume)?
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:FCD76BC9-9072-4811-8E5D-0334B0CF0364@.microsoft.com...
>A security feature? I cannot believe it cannot be turned off, if it cannot I
> am going back to SP3. I need to see what my stored procedures my application
> is calling and the parameters passed to them. How am I supposed to do this if
> the SP contains a parameter called password?
> This blocking seems silly to me.
> "Tibor Karaszi" wrote:
>> It is not configurable. It is a security feature in Profiler.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> Blog: http://solidqualitylearning.com/blogs/tibor/
>>
>> "nickname" <nickname@.online.nospam> wrote in message
>> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
>> > "-- 'password' was found in the text of this event.
>> > -- The text has been replaced with this comment for security reasons."
>> >
>> > How do I turn this functionality off? I need to display the SQL statement.
>>
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.|||A security feature? I cannot believe it cannot be turned off, if it cannot I
am going back to SP3. I need to see what my stored procedures my application
is calling and the parameters passed to them. How am I supposed to do this if
the SP contains a parameter called password?
This blocking seems silly to me.
"Tibor Karaszi" wrote:
> It is not configurable. It is a security feature in Profiler.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "nickname" <nickname@.online.nospam> wrote in message
> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> > "-- 'password' was found in the text of this event.
> > -- The text has been replaced with this comment for security reasons."
> >
> > How do I turn this functionality off? I need to display the SQL statement.
>|||Did you see this post-sp3? I thought that Profiler always hides the text. Perhaps they expanded it
from sp_password to just password? Anyhow, perhaps you can find something in ReadMe for the service
pack (4, I presume)?
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:FCD76BC9-9072-4811-8E5D-0334B0CF0364@.microsoft.com...
>A security feature? I cannot believe it cannot be turned off, if it cannot I
> am going back to SP3. I need to see what my stored procedures my application
> is calling and the parameters passed to them. How am I supposed to do this if
> the SP contains a parameter called password?
> This blocking seems silly to me.
> "Tibor Karaszi" wrote:
>> It is not configurable. It is a security feature in Profiler.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> Blog: http://solidqualitylearning.com/blogs/tibor/
>>
>> "nickname" <nickname@.online.nospam> wrote in message
>> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
>> > "-- 'password' was found in the text of this event.
>> > -- The text has been replaced with this comment for security reasons."
>> >
>> > How do I turn this functionality off? I need to display the SQL statement.
>>
"The text has been replaced with this comment for security reasons
"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.
Tuesday, March 6, 2012
"Password" data type
Hi,
I have a table which store the UserID and password in SQL
Server 2000.
Right now I use the "varchar" for the password column, but
when someone have the odbc link to the data from access or
crystal report, they can very easy to see all the password.
I am looking for something like in Access, you can put
the "Password" input mask, so when people open the
database, they can only see something like "****".
Thanks
HLHi,
Why dont you create SQL Server based logins, SO that passwords are encryted
and can not be decrypted. This will be the highest security mechnaism you
could go.
Still you could see the below article to encrypt a column.
http://www.mssqlserver.com/faq/general-encrypt.asp
Thanks
Hari
SQL Server MVP
"HL" wrote:
> Hi,
> I have a table which store the UserID and password in SQL
> Server 2000.
> Right now I use the "varchar" for the password column, but
> when someone have the odbc link to the data from access or
> crystal report, they can very easy to see all the password.
> I am looking for something like in Access, you can put
> the "Password" input mask, so when people open the
> database, they can only see something like "****".
> Thanks
> HL
>
>
I have a table which store the UserID and password in SQL
Server 2000.
Right now I use the "varchar" for the password column, but
when someone have the odbc link to the data from access or
crystal report, they can very easy to see all the password.
I am looking for something like in Access, you can put
the "Password" input mask, so when people open the
database, they can only see something like "****".
Thanks
HLHi,
Why dont you create SQL Server based logins, SO that passwords are encryted
and can not be decrypted. This will be the highest security mechnaism you
could go.
Still you could see the below article to encrypt a column.
http://www.mssqlserver.com/faq/general-encrypt.asp
Thanks
Hari
SQL Server MVP
"HL" wrote:
> Hi,
> I have a table which store the UserID and password in SQL
> Server 2000.
> Right now I use the "varchar" for the password column, but
> when someone have the odbc link to the data from access or
> crystal report, they can very easy to see all the password.
> I am looking for something like in Access, you can put
> the "Password" input mask, so when people open the
> database, they can only see something like "****".
> Thanks
> HL
>
>
Sunday, February 19, 2012
"hashed" password on alter login command
Hi,
I need to synchronise logins between 2 SQL2005 instances on a regular basis
- while you can copy the passwords to the destination using the "HASHED"
keyword on the CREATE LOGIN command, it appears that "HASHED" is missing fro
m
the ALTER LOGIN command. This means that I can't just update the password
when a user on the source instance changes the password on their SQL
authenticated account.
I also looked at using the transfer logins task in SSIS, but then read the
following in book online:
"At the destination, the transferred logins are disabled and assigned random
passwords. A member of the sysadmin role on the destination server must
change the passwords and enable the logins before the logins can be used. "
Apart from recording the login's roles, database access, and permissions,
dropping the login, creating with the hashed password, and re-applying the
roles/database access/permissions - has anybody found a way to just apply a
new hashed password to the login?
AndyHello Andy,
Thank you for posting in MSDN newsgroup!
I understand that you'd like to transfer logins and passwords between SQL
2005 instances. You just want to apply a new hashed password to the logins.
If I'm off-base, please let me know.
I think there is no simple method to apply a new hased password as you
want. You need to drop/recreate the logins by using script and grant it the
proper permission. You have to know the original password so that you could
change it to the new password by using "Alter login" statement.
You may want to refer to the following articles for more details:
How to transfer the logins and the passwords between instances of SQL
Server 2005
http://support.microsoft.com/kb/918992/
HOW TO: Transfer Logins and Passwords Between Instances of SQL Server
(246133)
http://support.microsoft.com/defaul...KB;EN-US;246133
Your feedback on this feature is routed to the proper channel. In the
meantime, I also encourage you submit via the link below
http://lab.msdn.microsoft.com/produ...ck/default.aspx
If anything is unclear or you have further questions on the issue, please
feel free to let's know.
Best Regards,
Peter Yang
MCSE2000/2003, MCSA, MCDBA
Microsoft Online Partner Support
========================================
=============
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscript...ault.aspx#notif
ications
<http://msdn.microsoft.com/subscript...ps/default.aspx>.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
<http://msdn.microsoft.com/subscript...rt/default.aspx>.
========================================
==========
This posting is provided "AS IS" with no warranties, and confers no rights.
I need to synchronise logins between 2 SQL2005 instances on a regular basis
- while you can copy the passwords to the destination using the "HASHED"
keyword on the CREATE LOGIN command, it appears that "HASHED" is missing fro
m
the ALTER LOGIN command. This means that I can't just update the password
when a user on the source instance changes the password on their SQL
authenticated account.
I also looked at using the transfer logins task in SSIS, but then read the
following in book online:
"At the destination, the transferred logins are disabled and assigned random
passwords. A member of the sysadmin role on the destination server must
change the passwords and enable the logins before the logins can be used. "
Apart from recording the login's roles, database access, and permissions,
dropping the login, creating with the hashed password, and re-applying the
roles/database access/permissions - has anybody found a way to just apply a
new hashed password to the login?
AndyHello Andy,
Thank you for posting in MSDN newsgroup!
I understand that you'd like to transfer logins and passwords between SQL
2005 instances. You just want to apply a new hashed password to the logins.
If I'm off-base, please let me know.
I think there is no simple method to apply a new hased password as you
want. You need to drop/recreate the logins by using script and grant it the
proper permission. You have to know the original password so that you could
change it to the new password by using "Alter login" statement.
You may want to refer to the following articles for more details:
How to transfer the logins and the passwords between instances of SQL
Server 2005
http://support.microsoft.com/kb/918992/
HOW TO: Transfer Logins and Passwords Between Instances of SQL Server
(246133)
http://support.microsoft.com/defaul...KB;EN-US;246133
Your feedback on this feature is routed to the proper channel. In the
meantime, I also encourage you submit via the link below
http://lab.msdn.microsoft.com/produ...ck/default.aspx
If anything is unclear or you have further questions on the issue, please
feel free to let's know.
Best Regards,
Peter Yang
MCSE2000/2003, MCSA, MCDBA
Microsoft Online Partner Support
========================================
=============
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscript...ault.aspx#notif
ications
<http://msdn.microsoft.com/subscript...ps/default.aspx>.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
<http://msdn.microsoft.com/subscript...rt/default.aspx>.
========================================
==========
This posting is provided "AS IS" with no warranties, and confers no rights.
Saturday, February 11, 2012
"confirm password" prompt after importing database
I'm running SQL Server 2000 on a Windows 2003 Server with the latest
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
JasonThis can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegroups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegroups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
JasonThis can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegroups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegroups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
"confirm password" prompt after importing database
I'm running SQL Server 2000 on a Windows 2003 Server with the latest
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
JasonThis can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegroups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegroups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
JasonThis can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegroups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegroups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
"confirm password" prompt after importing database
I'm running SQL Server 2000 on a Windows 2003 Server with the latest
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
Jason
This can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegr oups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>
|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason
|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegr oups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>
|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
SQL SP and hotfixes applied.
Today, I made a mistake while importing a new database into my SQL
Server. When choosing my options in the DTS wizard, I forgot to uncheck
the "Copy database users and database roles" and "copy object level
permissions" boxes under the Security options.
After running the import, whenever I try to edit any SQL user from a
remote client running Enterprise Manager, I am always prompted to
"confirm password." I cannot simply type in the password in that box
though, I have to actually type the password into the main user
properties window, then type it again to confirm the password. After
doing both, the changes are saved.
This ONLY happens from a remote Enterprise Manager client though. If I
use EM on the local server, I'm not prompted to confirm the password
when I edit users.
Can anyone provide some guidance on how I can fix this?
Thanks!
Jason
This can occur after appying MS03-031: Cumulative Security Patch for SQL
Server to the client running EM
FIX: You are prompted for password confirmation after you change a standard
SQL Server login
http://support.microsoft.com/?kbid=826161
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109789594.428951.221670@.g14g2000cwa.googlegr oups.com...
> I'm running SQL Server 2000 on a Windows 2003 Server with the latest
> SQL SP and hotfixes applied.
> Today, I made a mistake while importing a new database into my SQL
> Server. When choosing my options in the DTS wizard, I forgot to uncheck
> the "Copy database users and database roles" and "copy object level
> permissions" boxes under the Security options.
> After running the import, whenever I try to edit any SQL user from a
> remote client running Enterprise Manager, I am always prompted to
> "confirm password." I cannot simply type in the password in that box
> though, I have to actually type the password into the main user
> properties window, then type it again to confirm the password. After
> doing both, the changes are saved.
> This ONLY happens from a remote Enterprise Manager client though. If I
> use EM on the local server, I'm not prompted to confirm the password
> when I edit users.
> Can anyone provide some guidance on how I can fix this?
> Thanks!
> Jason
>
|||Jasper,
Thank you for taking time to respond.
I had found that posting, but I'd already patched the server with that
hotfix quite awhile ago, and the symptoms are not quite the same here.
With my issue, I am able to save the changes I made to the user, but it
just requires me to enter the password and confirm it every time I make
any change to a user. Also, this issue only occurs when I using
Enterprise Manager from a remote machine, but if I edit the users using
EM on the local machine, I do not get prompted to confirm the password.
Any other thoughts?
Thanks,
Jason
|||The hotfix is for the client as well as the server (like you say it's
confined to the client and doesn't occur on the server). You need to run the
hotfix from the KB on the client.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Jason S." <jasolution@.yahoo.com> wrote in message
news:1109790531.728123.199310@.f14g2000cwb.googlegr oups.com...
> Jasper,
> Thank you for taking time to respond.
> I had found that posting, but I'd already patched the server with that
> hotfix quite awhile ago, and the symptoms are not quite the same here.
> With my issue, I am able to save the changes I made to the user, but it
> just requires me to enter the password and confirm it every time I make
> any change to a user. Also, this issue only occurs when I using
> Enterprise Manager from a remote machine, but if I edit the users using
> EM on the local machine, I do not get prompted to confirm the password.
> Any other thoughts?
> Thanks,
> Jason
>
|||Jasper,
Thanks, that was it. I didn't realize that it was a patch for client EM
also.
Thanks again!
Jason
Thursday, February 9, 2012
"Closed" database
Hello,
I was wondering if it is possible to create a database that can be
accessed only using a username password combination, even when being
accessed from the Enterprise Manager.
It seems EM can always access all data, however when I distribute the
database, I don't want some tables to be viewed by my users.
Is this possible in SQL Server?
Thanks for any answer.
Best regards,H
i> database, I don't want some tables to be viewed by my users.
> Is this possible in SQL Server?
You cannot hide them, however if the user has EM on his box so register
the sql server with an appropiate permissions , I mean first of all DENY to
view /SELECT... to the specific user
<poostwoud@.gmail.com> wrote in message
news:1149755500.564173.157240@.u72g2000cwu.googlegroups.com...
> Hello,
> I was wondering if it is possible to create a database that can be
> accessed only using a username password combination, even when being
> accessed from the Enterprise Manager.
> It seems EM can always access all data, however when I distribute the
> database, I don't want some tables to be viewed by my users.
> Is this possible in SQL Server?
> Thanks for any answer.
> Best regards,
>|||Thanks for your answer,
However, when the user wants me to use an existing server, the user
already has sa rights most of the time.
Any member of the sysadmin role cannot be denied select rights as far
as I know?
Best regards,
Uri Dimant wrote:[vbcol=seagreen]
> H
> i> database, I don't want some tables to be viewed by my users.
> You cannot hide them, however if the user has EM on his box so register
> the sql server with an appropiate permissions , I mean first of all DENY t
o
> view /SELECT... to the specific user
> <poostwoud@.gmail.com> wrote in message
> news:1149755500.564173.157240@.u72g2000cwu.googlegroups.com...|||> Any member of the sysadmin role cannot be denied select rights as far
> as I know?
True
<poostwoud@.gmail.com> wrote in message
news:1149759179.371876.206990@.i40g2000cwc.googlegroups.com...
> Thanks for your answer,
> However, when the user wants me to use an existing server, the user
> already has sa rights most of the time.
> Any member of the sysadmin role cannot be denied select rights as far
> as I know?
> Best regards,
> Uri Dimant wrote:
>|||In SQL Server 2000, if you need to "hide" data from an sa,
you would need to use some type of third party encryption.
Check the links under field level encryption in the
following FAQ:
http://www.sqlsecurity.com/FAQs/SQL...55/Default.aspx
-Sue
On 8 Jun 2006 02:32:59 -0700, poostwoud@.gmail.com wrote:
[vbcol=seagreen]
>Thanks for your answer,
>However, when the user wants me to use an existing server, the user
>already has sa rights most of the time.
>Any member of the sysadmin role cannot be denied select rights as far
>as I know?
>Best regards,
>Uri Dimant wrote:|||In SQL Server 2000, if you need to "hide" data from an sa,
you would need to use some type of third party encryption.
Check the links under field level encryption in the
following FAQ:
http://www.sqlsecurity.com/FAQs/SQL...55/Default.aspx
-Sue
On 8 Jun 2006 02:32:59 -0700, poostwoud@.gmail.com wrote:
[vbcol=seagreen]
>Thanks for your answer,
>However, when the user wants me to use an existing server, the user
>already has sa rights most of the time.
>Any member of the sysadmin role cannot be denied select rights as far
>as I know?
>Best regards,
>Uri Dimant wrote:
I was wondering if it is possible to create a database that can be
accessed only using a username password combination, even when being
accessed from the Enterprise Manager.
It seems EM can always access all data, however when I distribute the
database, I don't want some tables to be viewed by my users.
Is this possible in SQL Server?
Thanks for any answer.
Best regards,H
i> database, I don't want some tables to be viewed by my users.
> Is this possible in SQL Server?
You cannot hide them, however if the user has EM on his box so register
the sql server with an appropiate permissions , I mean first of all DENY to
view /SELECT... to the specific user
<poostwoud@.gmail.com> wrote in message
news:1149755500.564173.157240@.u72g2000cwu.googlegroups.com...
> Hello,
> I was wondering if it is possible to create a database that can be
> accessed only using a username password combination, even when being
> accessed from the Enterprise Manager.
> It seems EM can always access all data, however when I distribute the
> database, I don't want some tables to be viewed by my users.
> Is this possible in SQL Server?
> Thanks for any answer.
> Best regards,
>|||Thanks for your answer,
However, when the user wants me to use an existing server, the user
already has sa rights most of the time.
Any member of the sysadmin role cannot be denied select rights as far
as I know?
Best regards,
Uri Dimant wrote:[vbcol=seagreen]
> H
> i> database, I don't want some tables to be viewed by my users.
> You cannot hide them, however if the user has EM on his box so register
> the sql server with an appropiate permissions , I mean first of all DENY t
o
> view /SELECT... to the specific user
> <poostwoud@.gmail.com> wrote in message
> news:1149755500.564173.157240@.u72g2000cwu.googlegroups.com...|||> Any member of the sysadmin role cannot be denied select rights as far
> as I know?
True
<poostwoud@.gmail.com> wrote in message
news:1149759179.371876.206990@.i40g2000cwc.googlegroups.com...
> Thanks for your answer,
> However, when the user wants me to use an existing server, the user
> already has sa rights most of the time.
> Any member of the sysadmin role cannot be denied select rights as far
> as I know?
> Best regards,
> Uri Dimant wrote:
>|||In SQL Server 2000, if you need to "hide" data from an sa,
you would need to use some type of third party encryption.
Check the links under field level encryption in the
following FAQ:
http://www.sqlsecurity.com/FAQs/SQL...55/Default.aspx
-Sue
On 8 Jun 2006 02:32:59 -0700, poostwoud@.gmail.com wrote:
[vbcol=seagreen]
>Thanks for your answer,
>However, when the user wants me to use an existing server, the user
>already has sa rights most of the time.
>Any member of the sysadmin role cannot be denied select rights as far
>as I know?
>Best regards,
>Uri Dimant wrote:|||In SQL Server 2000, if you need to "hide" data from an sa,
you would need to use some type of third party encryption.
Check the links under field level encryption in the
following FAQ:
http://www.sqlsecurity.com/FAQs/SQL...55/Default.aspx
-Sue
On 8 Jun 2006 02:32:59 -0700, poostwoud@.gmail.com wrote:
[vbcol=seagreen]
>Thanks for your answer,
>However, when the user wants me to use an existing server, the user
>already has sa rights most of the time.
>Any member of the sysadmin role cannot be denied select rights as far
>as I know?
>Best regards,
>Uri Dimant wrote:
Friday, January 27, 2012
'password' was found in the text of this event.
-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons.
Where can I find more info on this? Particularly, how to turn it off on our
development machines.
Jonathan AllenAFAIK, Its a security feature added in SP4 and its not configurable, ie, you
cannot turn it off.
Roji. P. Thomas
Net Asset Management
http://toponewithties.blogspot.com
"Jonathan Allen" <x@.x.x> wrote in message
news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
> -- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons.
> Where can I find more info on this? Particularly, how to turn it off on
> our development machines.
> --
> Jonathan Allen
>
>|||Does MS at least have a KB article explaining this "feature" and exactly
when it comes into play?
(Seems rather dubious to me, as you have to be an administrator to run the
profiler anyways.)
Jonathan Allen
"Roji. P. Thomas" <thomasroji@.gmail.com> wrote in message
news:ejz9X4UpFHA.2504@.tk2msftngp13.phx.gbl...
> AFAIK, Its a security feature added in SP4 and its not configurable, ie,
> you cannot turn it off.
>
> --
> Roji. P. Thomas
> Net Asset Management
> http://toponewithties.blogspot.com
>
> "Jonathan Allen" <x@.x.x> wrote in message
> news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
>|||>
> (Seems rather dubious to me, as you have to be an administrator to run the
> profiler anyways.)
But it does stop people seeing the password when they copy a trace file and
load into profiler on a machine where they do have admin rights.
John|||If they have access to the trace file, then I have a lot more worries than
just the user passwords. And what of my DBA calls the column passphrase
instead of password? If they gave us a editable list of words to block, then
I could see value in this. As it stands, I'm losing my ability to debug code
and all I'm getting is a false sense of security.
No wait, I'm also losing my ability to audit my servers. All a hacker has to
do is add /*password*/ to every command and I have no way to know what he is
doing.
Jonathan Allen
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
> But it does stop people seeing the password when they copy a trace file
> and load into profiler on a machine where they do have admin rights.
> John
>|||As you can never be 100% sure that you will never be hacked or abused by
someone with ligitimate access it is still the safest option.
John
"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> If they have access to the trace file, then I have a lot more worries than
> just the user passwords. And what of my DBA calls the column passphrase
> instead of password? If they gave us a editable list of words to block,
> then I could see value in this. As it stands, I'm losing my ability to
> debug code and all I'm getting is a false sense of security.
> No wait, I'm also losing my ability to audit my servers. All a hacker has
> to do is add /*password*/ to every command and I have no way to know what
> he is doing.
> --
> Jonathan Allen
>
> "John Bell" <jbellnewsposts@.hotmail.com> wrote in message
> news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
>|||"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
<snip> No wait, I'm also losing my ability to audit my servers. All a hacker
has to
> do is add /*password*/ to every command and I have no way to know what he
> is doing.
</snip>
I'd be more worried that your SQL Server is accessable at all from foreign
networks. I'd suggest that you tighten up the security of the server for
peace of mind. First add a firewall to the server itself, and only open
the ports that you're actually using. Make sure that the machine is places
so that it uses a private IP address i.e. 192.168.1.1 or something like
that. In an n-tier environment you can lock things up even better by
allowing only the next tier access to the machine, accomplished use of a
DMZ.
Of course, these are only a few ideas to think about I'm sure that the
experts on this newsgroup will be able to suggest about a billion more
security measures, and correct anything that I've said that is completely
wrong.
The point is that you need to lock up access to the production machine so
tight that no one can access it without express permission.
Regards
Colin Dawson
www.cjdawson.com|||I'm thinking about the "I think someone has gotten access and need to know
what is happening" situation. I trust our DBA and IT departments have
already made a reasonable attempt to lock-down the server.
Anyways, if anyone comes across MS's official reasoning behind this please
let me know.
Jonathan Allen
"Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
> "Jonathan Allen" <x@.x.x> wrote in message
> news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> <snip> No wait, I'm also losing my ability to audit my servers. All a
> hacker has to
> </snip>
> I'd be more worried that your SQL Server is accessable at all from foreign
> networks. I'd suggest that you tighten up the security of the server for
> peace of mind. First add a firewall to the server itself, and only open
> the ports that you're actually using. Make sure that the machine is
> places so that it uses a private IP address i.e. 192.168.1.1 or something
> like that. In an n-tier environment you can lock things up even better
> by allowing only the next tier access to the machine, accomplished use of
> a DMZ.
> Of course, these are only a few ideas to think about I'm sure that the
> experts on this newsgroup will be able to suggest about a billion more
> security measures, and correct anything that I've said that is completely
> wrong.
> The point is that you need to lock up access to the production machine so
> tight that no one can access it without express permission.
> Regards
> Colin Dawson
> www.cjdawson.com
>|||Hi,
I'm very interested in any answer about this myself. I am profiling an
application that uses the string 'password' a couple dozen times in schema
identifiers. This "feature" is annoying enough to make me miss helpful littl
e
Clippy.
This should be configurable. Though I understand that making it configurable
reduces the effectiveness as a security measure, I still feel that this goes
too far. Basically, I now have to spend significant time
researching/instrumenting code to capture the statements that are being hid
from me. Not happy about that.
Sorry to pile on and beat the dead horse, but this is hurting me right this
second, and I can't really roll back SPs on this server.
Thanks for reading,
Eric
"Jonathan Allen" wrote:
> I'm thinking about the "I think someone has gotten access and need to know
> what is happening" situation. I trust our DBA and IT departments have
> already made a reasonable attempt to lock-down the server.
>
> Anyways, if anyone comes across MS's official reasoning behind this please
> let me know.
> --
> Jonathan Allen
>
> "Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
> news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
>
>
-- The text has been replaced with this comment for security reasons.
Where can I find more info on this? Particularly, how to turn it off on our
development machines.
Jonathan AllenAFAIK, Its a security feature added in SP4 and its not configurable, ie, you
cannot turn it off.
Roji. P. Thomas
Net Asset Management
http://toponewithties.blogspot.com
"Jonathan Allen" <x@.x.x> wrote in message
news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
> -- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons.
> Where can I find more info on this? Particularly, how to turn it off on
> our development machines.
> --
> Jonathan Allen
>
>|||Does MS at least have a KB article explaining this "feature" and exactly
when it comes into play?
(Seems rather dubious to me, as you have to be an administrator to run the
profiler anyways.)
Jonathan Allen
"Roji. P. Thomas" <thomasroji@.gmail.com> wrote in message
news:ejz9X4UpFHA.2504@.tk2msftngp13.phx.gbl...
> AFAIK, Its a security feature added in SP4 and its not configurable, ie,
> you cannot turn it off.
>
> --
> Roji. P. Thomas
> Net Asset Management
> http://toponewithties.blogspot.com
>
> "Jonathan Allen" <x@.x.x> wrote in message
> news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
>|||>
> (Seems rather dubious to me, as you have to be an administrator to run the
> profiler anyways.)
But it does stop people seeing the password when they copy a trace file and
load into profiler on a machine where they do have admin rights.
John|||If they have access to the trace file, then I have a lot more worries than
just the user passwords. And what of my DBA calls the column passphrase
instead of password? If they gave us a editable list of words to block, then
I could see value in this. As it stands, I'm losing my ability to debug code
and all I'm getting is a false sense of security.
No wait, I'm also losing my ability to audit my servers. All a hacker has to
do is add /*password*/ to every command and I have no way to know what he is
doing.
Jonathan Allen
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
> But it does stop people seeing the password when they copy a trace file
> and load into profiler on a machine where they do have admin rights.
> John
>|||As you can never be 100% sure that you will never be hacked or abused by
someone with ligitimate access it is still the safest option.
John
"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> If they have access to the trace file, then I have a lot more worries than
> just the user passwords. And what of my DBA calls the column passphrase
> instead of password? If they gave us a editable list of words to block,
> then I could see value in this. As it stands, I'm losing my ability to
> debug code and all I'm getting is a false sense of security.
> No wait, I'm also losing my ability to audit my servers. All a hacker has
> to do is add /*password*/ to every command and I have no way to know what
> he is doing.
> --
> Jonathan Allen
>
> "John Bell" <jbellnewsposts@.hotmail.com> wrote in message
> news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
>|||"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
<snip> No wait, I'm also losing my ability to audit my servers. All a hacker
has to
> do is add /*password*/ to every command and I have no way to know what he
> is doing.
</snip>
I'd be more worried that your SQL Server is accessable at all from foreign
networks. I'd suggest that you tighten up the security of the server for
peace of mind. First add a firewall to the server itself, and only open
the ports that you're actually using. Make sure that the machine is places
so that it uses a private IP address i.e. 192.168.1.1 or something like
that. In an n-tier environment you can lock things up even better by
allowing only the next tier access to the machine, accomplished use of a
DMZ.
Of course, these are only a few ideas to think about I'm sure that the
experts on this newsgroup will be able to suggest about a billion more
security measures, and correct anything that I've said that is completely
wrong.
The point is that you need to lock up access to the production machine so
tight that no one can access it without express permission.
Regards
Colin Dawson
www.cjdawson.com|||I'm thinking about the "I think someone has gotten access and need to know
what is happening" situation. I trust our DBA and IT departments have
already made a reasonable attempt to lock-down the server.
Anyways, if anyone comes across MS's official reasoning behind this please
let me know.
Jonathan Allen
"Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
> "Jonathan Allen" <x@.x.x> wrote in message
> news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> <snip> No wait, I'm also losing my ability to audit my servers. All a
> hacker has to
> </snip>
> I'd be more worried that your SQL Server is accessable at all from foreign
> networks. I'd suggest that you tighten up the security of the server for
> peace of mind. First add a firewall to the server itself, and only open
> the ports that you're actually using. Make sure that the machine is
> places so that it uses a private IP address i.e. 192.168.1.1 or something
> like that. In an n-tier environment you can lock things up even better
> by allowing only the next tier access to the machine, accomplished use of
> a DMZ.
> Of course, these are only a few ideas to think about I'm sure that the
> experts on this newsgroup will be able to suggest about a billion more
> security measures, and correct anything that I've said that is completely
> wrong.
> The point is that you need to lock up access to the production machine so
> tight that no one can access it without express permission.
> Regards
> Colin Dawson
> www.cjdawson.com
>|||Hi,
I'm very interested in any answer about this myself. I am profiling an
application that uses the string 'password' a couple dozen times in schema
identifiers. This "feature" is annoying enough to make me miss helpful littl
e
Clippy.
This should be configurable. Though I understand that making it configurable
reduces the effectiveness as a security measure, I still feel that this goes
too far. Basically, I now have to spend significant time
researching/instrumenting code to capture the statements that are being hid
from me. Not happy about that.
Sorry to pile on and beat the dead horse, but this is hurting me right this
second, and I can't really roll back SPs on this server.
Thanks for reading,
Eric
"Jonathan Allen" wrote:
> I'm thinking about the "I think someone has gotten access and need to know
> what is happening" situation. I trust our DBA and IT departments have
> already made a reasonable attempt to lock-down the server.
>
> Anyways, if anyone comes across MS's official reasoning behind this please
> let me know.
> --
> Jonathan Allen
>
> "Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
> news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
>
>
Subscribe to:
Posts (Atom)
