Microsoft SQL Server 2005 JDBC Driver 1.1 on Solaris

hi,

Does MS2005 JDBC Driver 1.1 support integrated security on Solaris and if so
how?

Thanks,
MarcMOn Apr 24, 10:44 am, "Marc Melancon" <mmela...@.bmc.comwrote:

Quote:

Originally Posted by

hi,
>
Does MS2005 JDBC Driver 1.1 support integrated security on Solaris and if so
how?
>
Thanks,
MarcM

There's no such thing as integrated security between Solaris and MS.

Microsoft Security Bulletin MS06-071 ROLLBACK

Hi,
I am producing a Rollback plan in case I find any issue with MS06-071 hotfix
installation. We have several SQL 2005 Servers so I need to have this
rollback plan ready for the day we install this hotfix.
This is a hotfix for MSXML 6.0 which is needed for SQL 2005 Server. If
something goes wrong with the SQL server after I install this hotfix and I
uninstall this hotfix it automatically uninstall MSXML 6.0 as well.
My question is : do I have to install the whole SQL server 2005 again if I
uninstall this hotfix and therefore I uninstall MSXML 6.0? would it be enough
if I install MSXML 6.0 afterwards?
Thank you for your help
Best regards,
Juanjo
Hi Juanjo,
If you do need to uninstall MSXML6 after applying MS06-071 you can reinstall
MSXML6 MS06-061 or MSXML6 RTM directly without reinstalling SQL 2005.
However, most likely your SQL Server 2005 will not function until MSXML6 is
re-installed.
You can download MSXML6-061 from here -
http://www.microsoft.com/downloads/details.aspx?FamilyId=fd513435-fa6d-407c-bedc-5fd03e5b7d6c
or MSXML6 RTM from here -
http://www.microsoft.com/downloads/details.aspx?FamilyID=993C0BCF-3BCF-4009-BE21-27E85E1857B1&displaylang=en
However I hope MS06-071 rollout goes smoothly for you - if you have any
trouble please come to our blog site http://blogs.msdn.com/xmlteam and click
on the email link to let us know what's going on.
Thanks,
Adam Wiener [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
"Juanjo" <Juanjo@.discussions.microsoft.com> wrote in message
news:4F2BA3B9-0569-46A3-BB66-50FA01AA15F6@.microsoft.com...
> Hi,
> I am producing a Rollback plan in case I find any issue with MS06-071
> hotfix
> installation. We have several SQL 2005 Servers so I need to have this
> rollback plan ready for the day we install this hotfix.
> This is a hotfix for MSXML 6.0 which is needed for SQL 2005 Server. If
> something goes wrong with the SQL server after I install this hotfix and I
> uninstall this hotfix it automatically uninstall MSXML 6.0 as well.
> My question is : do I have to install the whole SQL server 2005 again if I
> uninstall this hotfix and therefore I uninstall MSXML 6.0? would it be
> enough
> if I install MSXML 6.0 afterwards?
> Thank you for your help
> Best regards,
> Juanjo

Microsoft Security Bulletin MS06-071 ROLLBACK

Hi,
I am producing a Rollback plan in case I find any issue with MS06-071 hotfix
installation. We have several SQL 2005 Servers so I need to have this
rollback plan ready for the day we install this hotfix.
This is a hotfix for MSXML 6.0 which is needed for SQL 2005 Server. If
something goes wrong with the SQL server after I install this hotfix and I
uninstall this hotfix it automatically uninstall MSXML 6.0 as well.
My question is : do I have to install the whole SQL server 2005 again if I
uninstall this hotfix and therefore I uninstall MSXML 6.0? would it be enoug
h
if I install MSXML 6.0 afterwards?
Thank you for your help
Best regards,
JuanjoHi Juanjo,
If you do need to uninstall MSXML6 after applying MS06-071 you can reinstall
MSXML6 MS06-061 or MSXML6 RTM directly without reinstalling SQL 2005.
However, most likely your SQL Server 2005 will not function until MSXML6 is
re-installed.
You can download MSXML6-061 from here -
http://www.microsoft.com/downloads/.../>
fd03e5b7d6c
or MSXML6 RTM from here -
http://www.microsoft.com/downloads/...&displaylang=en
However I hope MS06-071 rollout goes smoothly for you - if you have any
trouble please come to our blog site http://blogs.msdn.com/xmlteam and click
on the email link to let us know what's going on.
Thanks,
Adam Wiener [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
"Juanjo" <Juanjo@.discussions.microsoft.com> wrote in message
news:4F2BA3B9-0569-46A3-BB66-50FA01AA15F6@.microsoft.com...
> Hi,
> I am producing a Rollback plan in case I find any issue with MS06-071
> hotfix
> installation. We have several SQL 2005 Servers so I need to have this
> rollback plan ready for the day we install this hotfix.
> This is a hotfix for MSXML 6.0 which is needed for SQL 2005 Server. If
> something goes wrong with the SQL server after I install this hotfix and I
> uninstall this hotfix it automatically uninstall MSXML 6.0 as well.
> My question is : do I have to install the whole SQL server 2005 again if I
> uninstall this hotfix and therefore I uninstall MSXML 6.0? would it be
> enough
> if I install MSXML 6.0 afterwards?
> Thank you for your help
> Best regards,
> Juanjo

Microsoft Security Bulletin MS04-014

Vulnerability in the Microsoft Jet Database Engine Could Allow Code
Execution (837001)
Has anyone installed this patch yet? We ran it yesterday and now we can't
seem to manage our MSDE instance via an Access project. It simply says
(disconnected) at the top of the adp window. I've checked the Connection
proerties and everything looks good (the Test Connection) even succeeds.
I've tried with both Windows authentication and SQL Server authentication,
the tests always succeed, but the database remains disconnected. Anybody
else experiencing this problem or have suggestions as what to try?
Installed and Access project still working.
Michael Tissington
http://www.oaklodge.com
http://www.tabtag.com
"Steven Bergman" <sbergman@.newboundary.com> wrote in message
news:OBtP0Q9IEHA.3720@.TK2MSFTNGP11.phx.gbl...
> Vulnerability in the Microsoft Jet Database Engine Could Allow Code
> Execution (837001)
> Has anyone installed this patch yet? We ran it yesterday and now we can't
> seem to manage our MSDE instance via an Access project. It simply says
> (disconnected) at the top of the adp window. I've checked the Connection
> proerties and everything looks good (the Test Connection) even succeeds.
> I've tried with both Windows authentication and SQL Server authentication,
> the tests always succeed, but the database remains disconnected. Anybody
> else experiencing this problem or have suggestions as what to try?
>
|||Thanks. What versions are you using? We are on Access 2002 SP1 and MSDE
8.00.194.
What versions of Access and MSDE are you using?
"Michael Tissington" <michael@.nospam.com> wrote in message
news:OnEWxI%23IEHA.964@.TK2MSFTNGP10.phx.gbl...[vbcol=seagreen]
> Installed and Access project still working.
> --
> Michael Tissington
> http://www.oaklodge.com
> http://www.tabtag.com
> "Steven Bergman" <sbergman@.newboundary.com> wrote in message
> news:OBtP0Q9IEHA.3720@.TK2MSFTNGP11.phx.gbl...
can't[vbcol=seagreen]
Connection[vbcol=seagreen]
authentication,[vbcol=seagreen]
Anybody
>

Microsoft DevDays 2004 - Smart Client 3 - Security session

Hi there,
Have you guys watched the Smart Client 3: Developing Secure Smart Client
Applications by a presenter called Jeff Levinson
(http://msdn.microsoft.com/events/devdays/sessions/).
I have got a really really quick question regarding the security hole he
found on the demo...
(you need to have watched it to understand the following)
He said he decrypted his credential on the database server and upload his
database connection string in clear text' And then he can patcket sniff all
the traffic in between teh application server and the database server...
(Sorry, I may have heard it incorrectly as I was watching the webcast on the
net and English is not my mother tongue.)
Can someone explain to me a little more on what exactly did he mean.
Thanks heaps!!I have not watched this particular event but I have taught it. He is
probably talking about using IPSEC between the app server and database
server. This insures that you cannot use a packet sniffer to see the
unencrypted data on the network.
"one" <one@.discussions.microsoft.com> wrote in message
news:8E074D9C-184B-42BA-BFD8-FF33B3C1A659@.microsoft.com...
> Hi there,
> Have you guys watched the Smart Client 3: Developing Secure Smart Client
> Applications by a presenter called Jeff Levinson
> (http://msdn.microsoft.com/events/devdays/sessions/).
> I have got a really really quick question regarding the security hole he
> found on the demo...
> (you need to have watched it to understand the following)
> He said he decrypted his credential on the database server and upload his
> database connection string in clear text' And then he can patcket sniff
all
> the traffic in between teh application server and the database server...
> (Sorry, I may have heard it incorrectly as I was watching the webcast on
the
> net and English is not my mother tongue.)
> Can someone explain to me a little more on what exactly did he mean.
> Thanks heaps!!|||Thanks Chris. You are right. After reading your post, I went back and
listening to the webcast again and I found the transcript. And here is what
he said:
<snip>... There's one small problem, and that problem exists right here.
See I've gone and decrypted my database credentials, and then I've sent my
connection string to the database in plain text. Oops! With all this
security- all I need to do is drop a listener or somewhere on the network to
listen in between those two machines, and I'm going to pull back every piece
of data that you've put across the network we've gone through all this
trouble to secure... </snip>
And to resolve this issue, he suggested using IPSec.
Thanks again Chris.
"Chris Rolon" wrote:

> I have not watched this particular event but I have taught it. He is
> probably talking about using IPSEC between the app server and database
> server. This insures that you cannot use a packet sniffer to see the
> unencrypted data on the network.
>
> "one" <one@.discussions.microsoft.com> wrote in message
> news:8E074D9C-184B-42BA-BFD8-FF33B3C1A659@.microsoft.com...
> all
> the
>
>sql

Microsoft best practices for implementing windows authentication for sql server 2005

Microsoft recommends using Windows authentication instead of SQL Server authentication in SQL Server 2005 for improved security. What are the Microsoft best practices for implementing this? Will be helpful if someone also provides some links that talks about this....

The recommendation of using Windows authentication instead of SQL authentication is one of the best practices recommendations. One suggestion I have is to explicitly provision a Windows principal to make connection faster than if it were made by virtue of group membership.

BOL for SQL Server 2005 contains information about the authentication modes in the topic named "Authentication Mode". See also "How to: Change Server Authentication Mode "

I'm also including some SQL Server 2000 links from MSDN that refer to Windows Authentication:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_security_47u6.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/instsql/in_runsetup_6p9v.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/architec/8_ar_cs_79kj.asp

Finally, a search on the Internet for "Windows Authentication SQL Server" should provide you with additional links to discussions of Windows authentication.

Thanks
Laurentiu|||Hi Laurentiu,

Thanks for the reply. Can you suggest me wat considerations to be kept in mind incase we want to go for connection pooling as well as windows authentication simultaneously. How can we take the advantages of both?

Thanks in advance.

Abhi|||

Once you've established a connection, the authentication method that you used becomes less relevant. It might matter, for example, if the connection will be used to access resources outside the server, because in some scenarios, you would be able to go out using the Windows credentials, but for work performed inside the server it will not matter what was the authentication mode.

Windows authentication is recommended because with it, the authentication is done by Windows and SQL Server would not need to verify login passwords. Once you performed the authentication step and connected to the server, the way you authenticated becomes less important.

If the connections that you pool are made with Windows authentication, then you are taking advantage of both. Any other considerations would depend on the specific requirements of your application.

Thanks
Laurentiu

Microsoft Baseline Security Analyser 2.1

Hi

I downloaded MBSA and ran it against my SQL 2005 Server. It tells me that I have a severe risk because

'The following databases have public access.Remove the public access if it is not required - tempdb , model , msdb , ReportServer , ReportServerTempDB'

I have checked these databases and each have the Guest User but it is disabled. If I check the database properties the public role has no permissions against the listed databases.

Is this a bug with MBSA? If not how do I remove Public Access?

Hi Ewan, are you using a Xp_cmdshell enabled?

|||

Hi Emanuel

I an not sure what you mean. I have installed the product MBSA on a PC running VISTA business and am scanning the SQL server from this PC. The server operating system is Windows Server 2003 R2

Regards

|||

Hi Emanuel

I have now looked it up and xp_cmdshell is not enabled

Regards

|||

The MBSA given't u more details about this vulnerability message?

|||

Hi Emanuel

No MBSA gives no further information on this message

|||

Ewan, has your sql server a valid internet ip address or any other network vulnerability?

|||I mean, does your sql server is exposed on internet?|||

Hi Emanuel

Only via Reporting Services

|||

I'm suggest you investigate any vulnerability on SSRS like a public access on web service.

see the link below, there is a cool tool to do a verification on any possible network vulnerability.

http://www.gfi.com/lannetscan/?adv=40&loc=3&adclickid=14102298

Microsoft Access Security

I HAVE CREATED A SECURITY DATABASE USING A NEW WORKGROUP FILE WITH A NEW MDW FILE NAME. THE DATABASE ITSELF CONTAINS SEVERAL GROUPS OF USERS AND SEVERAL USERS. THE DATABASE WORKS AS DESIGNED.
THE PROBLEMS IS IF I OPEN THIS DATABASE USING THE SYSTEM.MDW FILE, THE DATABASE OPENS AND GIVE ME COMPLETE ACCESS TO EVERYTHING.

CAN ANYONE EXPLAIN WHAT IS HAPPENING.

ANY HELP WILL BE APPRECIATED

THANKING YOU IN ADVANCE

JOSEPH FORDDid you give the user Admin a password?

Did you join to the workgroup?|||Originally posted by Brett Kaiser
Did you give the user Admin a password?

Did you join to the workgroup?
I gave the admin a password and then created a new administer with a different name.

When I open the database with the workgroup I created it works fine.
but when I open the database with the system.mdw workgroup it allow me to enter the database. which should not be. I am missing something.

Thanks|||And it doesn't ask you for a password, right?|||Originally posted by Brett Kaiser
And it doesn't ask you for a password, right?

Yes that is correct. The following information I found in Q/A section. What do you make of this.
10. Additionally, you may need manually to remove the Open/Run permission from the database container for the Users group through the security menus or through code. This will prevent someone from opening the database by using another workgroup information file or the default System.mda/mdw. In Microsoft Access 97, the User Level Security Wizard is supposed to remove the Open/Run database permissions for the Users group, but fails to do so. The Access 2000 Security Wizard removes permissions to the point where they are not visible on the security menus, but testing has revealed that in Access 2000 it is possible to open a database by using the default workgroup information file regardless of the menu settings. The cure for both versions of Access is to create a new, empty database while logged on as a member of the Admins group and import all of the objects from the secured database. You should take this step before spending too much time securing objects because Access considers imported objects to be new and loses the permission information that was stored in the source database.|||Yeah..it's a toy...

Don't use the default workgroup...

But you said you removed all of the permissions from Admin (that's what it's opening with), but it doesn't seem to be the case...

You sure your removed Admin from the Admin group?

And made sure it had no permissions?|||Originally posted by Brett Kaiser
Yeah..it's a toy...

Don't use the default workgroup...

But you said you removed all of the permissions from Admin (that's what it's opening with), but it doesn't seem to be the case...

You sure your removed Admin from the Admin group?

And made sure it had no permissions?

I think I have but could be wrong. I have attached a file that I would appreciate your looking at to see if you can see the problelm.

Thanks for your help

Joe Ford|||I think you forgot the attachment...|||Originally posted by Brett Kaiser
I think you forgot the attachment...

Your are right. I have attached it now. Please forgive my senior memo.|||OK,

How about what he permissions are fopr the user group...|||Originally posted by Brett Kaiser
OK,

How about what he permissions are fopr the user group...

ALL USERS ARE PART OF THE USER GROUP AND THAT GROUP HAS NO PERMISSION AT ALL INCLUDING ADMIN.|||Yeah...I figured as much...

Who is the owner of all the objects...Where they all originally created by Admin?|||Originally posted by Brett Kaiser
Yeah...I figured as much...

Who is the owner of all the objects...Where they all originally created by Admin?

Owner is Poweradmin see attached|||What about the other objects (like tables, macros, ect)...don't know if dbowner does it...I think it should...

who owns them?|||Originally posted by Brett Kaiser
What about the other objects (like tables, macros, ect)...don't know if dbowner does it...I think it should...

who owns them?

they are all owned by poweradmin|||Make sure u encrypt ur database using workgroup information file

Also inform u are whitout knowing that even if u create particular
security file for an access database .. .Users group which is default to any *.mdw file will be created and access won't allow u to delete it ...

however make sure you didn't grant any permission to this group

regards ...