"The text has been replaced with this comment for security reasons"

Is it possible to disable this security feature (need it on a dev.
box)
Morten
I don't believe it's possible to disable this behaviour in Profiler (it
would kind of defeat its purpose) .
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"wapsiii" <wapsiii@.otmail.com> wrote in message
news:lmoul11as3fo24vdpcd6dollue134qq4v0@.4ax.com...
> Is it possible to disable this security feature (need it on a dev.
> box)
> Morten
|||Well yes, but nice on a dev. box :|
On Wed, 26 Oct 2005 14:40:46 +0100, "Jasper Smith"
<jasper_smith9@.hotmail.com> wrote:

>I don't believe it's possible to disable this behaviour in Profiler (it
>would kind of defeat its purpose) .

"The text has been replaced with this comment for security reasons

"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.
It is not configurable. It is a security feature in Profiler.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.

"The text has been replaced with this comment for security reasons

"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.|||A security feature? I cannot believe it cannot be turned off, if it cannot I
am going back to SP3. I need to see what my stored procedures my application
is calling and the parameters passed to them. How am I supposed to do this if
the SP contains a parameter called password?
This blocking seems silly to me.
"Tibor Karaszi" wrote:
> It is not configurable. It is a security feature in Profiler.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "nickname" <nickname@.online.nospam> wrote in message
> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> > "-- 'password' was found in the text of this event.
> > -- The text has been replaced with this comment for security reasons."
> >
> > How do I turn this functionality off? I need to display the SQL statement.
>|||Did you see this post-sp3? I thought that Profiler always hides the text. Perhaps they expanded it
from sp_password to just password? Anyhow, perhaps you can find something in ReadMe for the service
pack (4, I presume)?
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:FCD76BC9-9072-4811-8E5D-0334B0CF0364@.microsoft.com...
>A security feature? I cannot believe it cannot be turned off, if it cannot I
> am going back to SP3. I need to see what my stored procedures my application
> is calling and the parameters passed to them. How am I supposed to do this if
> the SP contains a parameter called password?
> This blocking seems silly to me.
> "Tibor Karaszi" wrote:
>> It is not configurable. It is a security feature in Profiler.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> Blog: http://solidqualitylearning.com/blogs/tibor/
>>
>> "nickname" <nickname@.online.nospam> wrote in message
>> news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
>> > "-- 'password' was found in the text of this event.
>> > -- The text has been replaced with this comment for security reasons."
>> >
>> > How do I turn this functionality off? I need to display the SQL statement.
>>

"The text has been replaced with this comment for security reasons

"-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons."
How do I turn this functionality off? I need to display the SQL statement.It is not configurable. It is a security feature in Profiler.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"nickname" <nickname@.online.nospam> wrote in message
news:19DCF747-8DA3-45DF-B1FD-A62B629CFE36@.microsoft.com...
> "-- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons."
> How do I turn this functionality off? I need to display the SQL statement.

"Data Source=localhost;..." fails with : General network error.

I replaced SQL 2000 with SQL 2005 Developer edition and my application could
not connect
to the local SQL server anymore. When connecting from a .Net 1.1 application
using the
following connection string:
"Data Source=localhost;Database=MM;Integrated Security=SSPI"
I always received the following exception message:
"General network error. Check your network documentation."
I had no problem to connect when using the host name instead of "localhost".
The problem
got resolved when I started "SQL Server Surface Area Configuration" and conf
igured it as
follow:
Surface Area Configuration for Services and Connections -> Database Engine -
> Remote
Connections -> Local and remote connections -> Using TCP/IP only.
The SQL 2005 Developer Edition is configured out of the box with "Local conn
ections only"
and "localhost" for some reason is not recognized as a local connection !!!!Try . or (local) or servername or IP address.
"Gaetan" <someone@.somewhere.com> wrote in message
news:14fhn1dr367kni9qt8vp7j5rb70imtelhl@.
4ax.com...
>I replaced SQL 2000 with SQL 2005 Developer edition and my application
>could not connect
> to the local SQL server anymore. When connecting from a .Net 1.1
> application using the
> following connection string:
> "Data Source=localhost;Database=MM;Integrated Security=SSPI"
> I always received the following exception message:
> "General network error. Check your network documentation."
> I had no problem to connect when using the host name instead of
> "localhost". The problem
> got resolved when I started "SQL Server Surface Area Configuration" and
> configured it as
> follow:
> Surface Area Configuration for Services and Connections -> Database
> Engine -> Remote
> Connections -> Local and remote connections -> Using TCP/IP only.
> The SQL 2005 Developer Edition is configured out of the box with "Local
> connections only"
> and "localhost" for some reason is not recognized as a local connection
> !!!!
>

'password' was found in the text of this event.

-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons.
Where can I find more info on this? Particularly, how to turn it off on our
development machines.
Jonathan AllenAFAIK, Its a security feature added in SP4 and its not configurable, ie, you
cannot turn it off.
Roji. P. Thomas
Net Asset Management
http://toponewithties.blogspot.com
"Jonathan Allen" <x@.x.x> wrote in message
news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
> -- 'password' was found in the text of this event.
> -- The text has been replaced with this comment for security reasons.
> Where can I find more info on this? Particularly, how to turn it off on
> our development machines.
> --
> Jonathan Allen
>
>|||Does MS at least have a KB article explaining this "feature" and exactly
when it comes into play?
(Seems rather dubious to me, as you have to be an administrator to run the
profiler anyways.)
Jonathan Allen
"Roji. P. Thomas" <thomasroji@.gmail.com> wrote in message
news:ejz9X4UpFHA.2504@.tk2msftngp13.phx.gbl...
> AFAIK, Its a security feature added in SP4 and its not configurable, ie,
> you cannot turn it off.
>
> --
> Roji. P. Thomas
> Net Asset Management
> http://toponewithties.blogspot.com
>
> "Jonathan Allen" <x@.x.x> wrote in message
> news:ON5rgxTpFHA.1044@.tk2msftngp13.phx.gbl...
>|||>
> (Seems rather dubious to me, as you have to be an administrator to run the
> profiler anyways.)
But it does stop people seeing the password when they copy a trace file and
load into profiler on a machine where they do have admin rights.
John|||If they have access to the trace file, then I have a lot more worries than
just the user passwords. And what of my DBA calls the column passphrase
instead of password? If they gave us a editable list of words to block, then
I could see value in this. As it stands, I'm losing my ability to debug code
and all I'm getting is a false sense of security.
No wait, I'm also losing my ability to audit my servers. All a hacker has to
do is add /*password*/ to every command and I have no way to know what he is
doing.
Jonathan Allen
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
> But it does stop people seeing the password when they copy a trace file
> and load into profiler on a machine where they do have admin rights.
> John
>|||As you can never be 100% sure that you will never be hacked or abused by
someone with ligitimate access it is still the safest option.
John
"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> If they have access to the trace file, then I have a lot more worries than
> just the user passwords. And what of my DBA calls the column passphrase
> instead of password? If they gave us a editable list of words to block,
> then I could see value in this. As it stands, I'm losing my ability to
> debug code and all I'm getting is a false sense of security.
> No wait, I'm also losing my ability to audit my servers. All a hacker has
> to do is add /*password*/ to every command and I have no way to know what
> he is doing.
> --
> Jonathan Allen
>
> "John Bell" <jbellnewsposts@.hotmail.com> wrote in message
> news:%23FhnogcpFHA.2904@.tk2msftngp13.phx.gbl...
>|||"Jonathan Allen" <x@.x.x> wrote in message
news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
<snip> No wait, I'm also losing my ability to audit my servers. All a hacker
has to
> do is add /*password*/ to every command and I have no way to know what he
> is doing.
</snip>
I'd be more worried that your SQL Server is accessable at all from foreign
networks. I'd suggest that you tighten up the security of the server for
peace of mind. First add a firewall to the server itself, and only open
the ports that you're actually using. Make sure that the machine is places
so that it uses a private IP address i.e. 192.168.1.1 or something like
that. In an n-tier environment you can lock things up even better by
allowing only the next tier access to the machine, accomplished use of a
DMZ.
Of course, these are only a few ideas to think about I'm sure that the
experts on this newsgroup will be able to suggest about a billion more
security measures, and correct anything that I've said that is completely
wrong.
The point is that you need to lock up access to the production machine so
tight that no one can access it without express permission.
Regards
Colin Dawson
www.cjdawson.com|||I'm thinking about the "I think someone has gotten access and need to know
what is happening" situation. I trust our DBA and IT departments have
already made a reasonable attempt to lock-down the server.
Anyways, if anyone comes across MS's official reasoning behind this please
let me know.
Jonathan Allen
"Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
> "Jonathan Allen" <x@.x.x> wrote in message
> news:esprGogpFHA.3656@.TK2MSFTNGP09.phx.gbl...
> <snip> No wait, I'm also losing my ability to audit my servers. All a
> hacker has to
> </snip>
> I'd be more worried that your SQL Server is accessable at all from foreign
> networks. I'd suggest that you tighten up the security of the server for
> peace of mind. First add a firewall to the server itself, and only open
> the ports that you're actually using. Make sure that the machine is
> places so that it uses a private IP address i.e. 192.168.1.1 or something
> like that. In an n-tier environment you can lock things up even better
> by allowing only the next tier access to the machine, accomplished use of
> a DMZ.
> Of course, these are only a few ideas to think about I'm sure that the
> experts on this newsgroup will be able to suggest about a billion more
> security measures, and correct anything that I've said that is completely
> wrong.
> The point is that you need to lock up access to the production machine so
> tight that no one can access it without express permission.
> Regards
> Colin Dawson
> www.cjdawson.com
>|||Hi,
I'm very interested in any answer about this myself. I am profiling an
application that uses the string 'password' a couple dozen times in schema
identifiers. This "feature" is annoying enough to make me miss helpful littl
e
Clippy.
This should be configurable. Though I understand that making it configurable
reduces the effectiveness as a security measure, I still feel that this goes
too far. Basically, I now have to spend significant time
researching/instrumenting code to capture the statements that are being hid
from me. Not happy about that.
Sorry to pile on and beat the dead horse, but this is hurting me right this
second, and I can't really roll back SPs on this server.
Thanks for reading,
Eric
"Jonathan Allen" wrote:

> I'm thinking about the "I think someone has gotten access and need to know
> what is happening" situation. I trust our DBA and IT departments have
> already made a reasonable attempt to lock-down the server.
>
> Anyways, if anyone comes across MS's official reasoning behind this please
> let me know.
> --
> Jonathan Allen
>
> "Colin Dawson" <newsgroups@.cjdawson.com> wrote in message
> news:D%XNe.93164$G8.33225@.text.news.blueyonder.co.uk...
>
>