Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion Groups
DB Engine
SQL ServerMSDESQL Server CE
Services
Analysis (Data Mining)Analysis (OLAP)DTSIntegration ServicesNotification ServicesReporting Services
Programming
CLRConnectivitySQLXML
Other Technologies
ClusteringEnglish QueryFull-Text SearchReplicationService Broker
General
Data WarehousingPerformanceSecuritySetupSQL Server ToolsOther SQL Server Topics
DirectoryUser Groups
Related Topics
MS AccessOther DB ProductsMS Server Products.NET DevelopmentVB DevelopmentJava DevelopmentMore Topics ...

SQL Server Forum / General / Security / April 2006

Tip: Looking for answers? Try searching our database.

How to hide unauthorized databases with SQL 2005?

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
SL Coder - 25 Apr 2006 02:29 GMT
Hi,

I have configure permission for userA and he can access only one database.
When user estabilish the connection via management studio, though he cannot
access other databases, he can see them. Is it possible to hide other
databases for userA?

Appreciate all your reply.

Shane
Dan Guzman - 25 Apr 2006 03:44 GMT
VIEW ANY DATABASE is granted to public by default.  If you want to remove
this permission from userA:

   USE master
   DENY VIEW ANY DATABASE TO userA

Although the user still has VIEW ANY DATABASE via public role membership,
the DENY takes precedence.

You could also REVOKE VIEW ANY DATABASE from public and then selectively
grant that permission to users as you see fit.

Signature

Hope this helps.

Dan Guzman
SQL Server MVP

> Hi,
>
[quoted text clipped - 6 lines]
>
> Shane
SL Coder - 25 Apr 2006 04:49 GMT
Thanks for the reply Dan. But the problem is, this statement applies for all databases that is not what I want. I need to allow userA to see one database while denying other databases. Is it possible. Have I missed anything?

Shane

 VIEW ANY DATABASE is granted to public by default.  If you want to remove
 this permission from userA:

     USE master
     DENY VIEW ANY DATABASE TO userA

 Although the user still has VIEW ANY DATABASE via public role membership,
 the DENY takes precedence.

 You could also REVOKE VIEW ANY DATABASE from public and then selectively
 grant that permission to users as you see fit.

 --
 Hope this helps.

 Dan Guzman
 SQL Server MVP

 "SL Coder" <sl_coder@hotmail.com> wrote in message
 news:e50gEfAaGHA.3704@TK2MSFTNGP03.phx.gbl...
 > Hi,
 >
 > I have configure permission for userA and he can access only one database.
 > When user estabilish the connection via management studio, though he
 > cannot access other databases, he can see them. Is it possible to hide
 > other databases for userA?
 >
 > Appreciate all your reply.
 >
 > Shane
 >
Uri Dimant - 25 Apr 2006 06:54 GMT
SL
Well, this unwanted user must be connected via SSMS (am I right?) and if you have not added him/her to the database , he/she will see the database's name but cannot access to
 Thanks for the reply Dan. But the problem is, this statement applies for all databases that is not what I want. I need to allow userA to see one database while denying other databases. Is it possible. Have I missed anything?

 Shane

 "Dan Guzman" <guzmanda@nospam-online.sbcglobal.net> wrote in message news:%2300soIBaGHA.3304@TK2MSFTNGP04.phx.gbl...
   VIEW ANY DATABASE is granted to public by default.  If you want to remove
   this permission from userA:

       USE master
       DENY VIEW ANY DATABASE TO userA

   Although the user still has VIEW ANY DATABASE via public role membership,
   the DENY takes precedence.

   You could also REVOKE VIEW ANY DATABASE from public and then selectively
   grant that permission to users as you see fit.

   --
   Hope this helps.

   Dan Guzman
   SQL Server MVP

   "SL Coder" <sl_coder@hotmail.com> wrote in message
   news:e50gEfAaGHA.3704@TK2MSFTNGP03.phx.gbl...
   > Hi,
   >
   > I have configure permission for userA and he can access only one database.
   > When user estabilish the connection via management studio, though he
   > cannot access other databases, he can see them. Is it possible to hide
   > other databases for userA?
   >
   > Appreciate all your reply.
   >
   > Shane
   >
Dan Guzman - 25 Apr 2006 13:00 GMT
After VIEW ANY DATABASE is denied, only master, tempdb, and databases that
the login owns are visible.  Other databases that the user can access are
not enumerated but can still be accessed directly by setting the database
context (e.g. USE).  Unfortunately, SSMS Object Explorer functionality is
limited to visible databases.

The reason for this behavior is that it is necessary to open each database
on the server to determine whether or not a non-privileged login has
database access.  This caused performance issues on servers with a lot
(100's) of databases.

If this feature is important to you, make a suggestion (or vote on the
importance if already submitted) at the product feedback center:
http://lab.msdn.microsoft.com/productfeedback/default.aspx

Signature

Hope this helps.

Dan Guzman
SQL Server MVP

Thanks for the reply Dan. But the problem is, this statement applies for all
databases that is not what I want. I need to allow userA to see one database
while denying other databases. Is it possible. Have I missed anything?

Shane

 VIEW ANY DATABASE is granted to public by default.  If you want to remove
 this permission from userA:

     USE master
     DENY VIEW ANY DATABASE TO userA

 Although the user still has VIEW ANY DATABASE via public role membership,
 the DENY takes precedence.

 You could also REVOKE VIEW ANY DATABASE from public and then selectively
 grant that permission to users as you see fit.

 --
 Hope this helps.

 Dan Guzman
 SQL Server MVP

 "SL Coder" <sl_coder@hotmail.com> wrote in message
 news:e50gEfAaGHA.3704@TK2MSFTNGP03.phx.gbl...
 > Hi,
 >
 > I have configure permission for userA and he can access only one
database.
 > When user estabilish the connection via management studio, though he
 > cannot access other databases, he can see them. Is it possible to hide
 > other databases for userA?
 >
 > Appreciate all your reply.
 >
 > Shane
 >
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.