How do I Hide Databases from External Users?

I am going to give user rights for an external user to connect to my SQL Server via Client Network Utility.

Atlough I have given user permissions to only access one database and not the whole list, how do I make sure that they cannot see all the other databases on my SQL Server?

I have 20 instances of databases on my SQL Server and ideally I would like to give 20 different people access - but each of them when they enter my SQL Server, should not even know that the other databases exist.

Thanks.RE:
Q1 I am going to give user rights for an external user to connect to my SQL Server via Client Network Utility.

Q2 Although I have given user permissions to only access one database and not the whole list, how do I make sure that they cannot see all the other databases on my SQL Server?

I have 20 instances of databases on my SQL Server and ideally I would like to give 20 different people access -

Q3 but each of them when they enter my SQL Server, should not even know that the other databases exist. Thanks.

A1 {What was meant is not 100% clear; however, bestowing "[user rights for an external user to connect to SQL Server]" would generally be accomplished within Enterprise Manager, *Query Analyser, osql, isql, or programmatically, i.e.(via an API: ADO, CLib, DMO, OLEDB, etc.,); but not via the Client Network Utility (at least not directly)?}

A2 One may meet such requirements by designing the user application(s), i.e.(the ones the users will use with their respective DBs), such that other DB catalogs are not displayed. (This is arguably probably one of the better means of meeting such a requirement.)

Note: Various "all encompassing" implementation approaches may entail significant negative consequences. For example this includes many implementations that:
a Deny users Select and Exec rights to certain objects in the Master DB.
b Modify / add objects to the Master DB (this option especially, is NOT recommended).
c Require special connectivity software that supports the desired feature set (custom made ODBC, Sql Server, OLEDB, etc., drivers).

A3 You may wish to verify that this is in fact an important requirement. (That is, one that is worth the ramifications of the means chosen to implement a design that will meet the requirement.) As noted in A2, maintainability and / or functionality may be impaired with some kinds of "DB hiding" implementation approaches.

--

* The following Special Stored Procedures are supported in MS Sql Server 2k (execute from QA, etc.) for managing security:
sp_addalias
sp_addapprole
sp_addgroup
sp_addlinkedsrvlogin
sp_addlogin
sp_addremotelogin
sp_addrole
sp_addrolemember
sp_addserver
sp_addsrvrolemember
sp_adduser
sp_approlepassword
sp_change_users_login
sp_changedbowner
sp_changegroup
sp_changeobjectowner
sp_dbfixedrolepermission
sp_defaultdb
sp_defaultlanguage
sp_denylogin
sp_dropalias
sp_dropapprole
sp_dropgroup
sp_droplinkedsrvlogin
sp_droplogin
sp_dropremotelogin
sp_droprole
sp_droprolemember
sp_dropserver
sp_dropsrvrolemember
sp_dropuser
sp_grantdbaccess
sp_grantlogin
sp_helpdbfixedrole
sp_helpgroup
sp_helplinkedsrvlogin
sp_helplogins
sp_helpntgroup
sp_helpremotelogin
sp_helprole
sp_helprolemember
sp_helprotect
sp_helpsrvrole
sp_helpsrvrolemember
sp_helpuser
sp_password
sp_remoteoption
sp_revokedbaccess
sp_revokelogin
sp_setapprole
sp_srvrolepermission
sp_validatelogins|||With what tools will your users be connecting to your Server? ODBC, OSQL, Enterprise Manager?|||Originally posted by Paul Young
With what tools will your users be connecting to your Server? ODBC, OSQL, Enterprise Manager?

Thank you for your posts :)

I am using EM to connect|||Great, what will your users use to connect?

If your users will use EM or Query Analyzer then they have enough to see the diffrent DBs with little to no effort. A knowlegable user can even see system tables via I/OSQL. Past that, in ODBC a use will still be able to get a list of DB's if they specify a database when setting up the DSN.sql

How do i give SQL administrator full rights to SQL 2005 without OS rights

The DBA at our location is demanding local admin (windows) right's to the box so he can function. Right now when he logs in i have given him right's to the inetpub directory, sql directory, i have set him as a sysadmin on sql2005 and gone into the http:\\localhost\reports and set him up as a system manager and under site priveledges set him as a sys admin. When he tries to login and configure the report server he gets the following error:

Title-Reporting services configuration manager

Error-There was an error refreshing the UI. bla bla bla

A WMI error has occurred and no additional error information is availiable

Title-Reporting services configuration manager

Error-There was an error while switching panels. The most likely cause is an error retrieving WMI properties. bla bla bla

A WMI error has occurred and no additional error information is availiable

then when he's in sql server 2005 surface area configuation

Title-Surface Area Configuration

Error-Access denied (system.management)

Is there any documentation or anythign anyone can tell me that i can do to give this DBA full access to configure and admin the SQL portion of his system without giving him admin rights to the OS?

Please help!!

Thanks for any time anyone has taken to review this thread!!

There's no issue in giving him/her admin rights to the box. In most cases, he'll/she'll need it. Don't confuse local admin on the box with network admin rights.

Adamus

|||

That's the problem in my environment i cant give local admin rights to any box. This is per PCI requirements which is a credit card VISA format amongst other regulations i'm under.

Do you have any other info that can provide assistance?

|||I

The DBA at our location is demanding local admin (windows) right's to the box so he can function. Right now when he logs in i have given him right's to the inetpub directory, sql directory, i have set him as a sysadmin on sql2005 and gone into the http:\\localhost\reports and set him up as a system manager and under site priveledges set him as a sys admin. When he tries to login and configure the report server he gets the following error:

Title-Reporting services configuration manager

Error-There was an error refreshing the UI. bla bla bla

A WMI error has occurred and no additional error information is availiable

Title-Reporting services configuration manager

Error-There was an error while switching panels. The most likely cause is an error retrieving WMI properties. bla bla bla

A WMI error has occurred and no additional error information is availiable

then when he's in sql server 2005 surface area configuation

Title-Surface Area Configuration

Error-Access denied (system.management)

Is there any documentation or anythign anyone can tell me that i can do to give this DBA full access to configure and admin the SQL portion of his system without giving him admin rights to the OS?

|||Moving to the SQL Server Security Forum.|||

ok i think i figured out the surface area config issue, theres a link that states : Add new administrator in which i did and i can access all pages now, but it wont obviously let a non admin restart services, since there's a handful of services i think i'll just have/set the services under the SQL admins credentials, unless someone knows of a better way, in which i can allow the sql admin to restart services?

On the other issue i still cant access the reporting service configuration page, still recieving a WMI error?//

Please anyone HELP!!

|||

These sources should help you understand and configure the appropriate account/security for your DBA.

Configuration -Service Accounts, SQL Server 2005 - Setting Up Windows Service Accounts
http://msdn2.microsoft.com/en-us/library/ms143691.aspx
http://msdn2.microsoft.com/en-us/library/ms143504.aspx

Configuration -Service Accounts, SQL Server or SQL Server Agent service account
http://support.microsoft.com/kb/283811/en-us
http://msdn2.microsoft.com/en-us/library/ms143691.aspx

Configuration -Service Accounts,Selecting an Account for the SQL Server Agent Service
http://msdn2.microsoft.com/en-us/library/ms191543.aspx
http://support.microsoft.com/kb/907557

|||

Ok i was looking over the attached documents. It pretty much looks from what you've given me, if i setup the services on the local machine to run under the SQL DBA's credentials that i wont need to do anything further, this will in turn give the SQL DBA access without any errors?

Personally i dont think the service items are the issues but if you're positive this will do what i dneed to do i'll try it. Please reconfirm my understanding of the situation before i attempt to run changes please.

Again thanks for your assistance.

How do I find I am administrator?

Hi Sunny,
1.What is that means. I do not have admin rights to whole server?
Based on the output you fell inside the 'db_owner' role in your database.
This ensure that you can do any activiites inside that database.
But you not in the part of 'SYSADMIN' role, which is the server wide role.
Due to that your SP_HELPLOGINS failed. This command will list the details of
all Logins who can access SQL server.
2.What is that means. I do not have admin rights to whole server?
Yes, You have full access to only ur database.
3.Is package admin is different than server adminn?
Yes, While saving the package you can mention a Owner password. That might
be needed while accessing the exiting package.
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
> "Hari" <hari_prasad_k@.hotmail.com> wrote in message
> news:#CzPhl4GEHA.3772@.TK2MSFTNGP12.phx.gbl...
SQL
> I selected MyTestDB and ran the store proc and it returns 3 records,
> extracts from the query results:
> GroupName DefDBName
> db_owner master
> db_accessadmin master
> db_ddladmin master
> I believe I have admin rights to MyTestDb.
> Then I selected master database and ran same sp. I got message "User does
> not have permission to perform this action."
> What is that means. I do not have admin rights to whole server?
> the
> Is package admin is different than server adminn?
> Thank you very much for providing detail information.
> SQL
installed
> admin
> change
> any
manager
> on
>
Thanks Hari.
Since I am db_owner, why I am not able to create new store procedure, view
and table? It gives me error "CREATE TABLE permission denied in database
'myTestDB'.
Your suggestion would be great help.
"Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
> Hi Sunny,
> 1.What is that means. I do not have admin rights to whole server?
> Based on the output you fell inside the 'db_owner' role in your database.
> This ensure that you can do any activiites inside that database.
> But you not in the part of 'SYSADMIN' role, which is the server wide
role.
> Due to that your SP_HELPLOGINS failed. This command will list the details
of
> all Logins who can access SQL server.
> 2.What is that means. I do not have admin rights to whole server?
> Yes, You have full access to only ur database.
> 3.Is package admin is different than server adminn?
> Yes, While saving the package you can mention a Owner password. That might
> be needed while accessing the exiting package.
> Thanks
> Hari
> MCDBA
>
> "Sunny" <sunny_1178@.hotmail.com> wrote in message
> news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
am
> SQL
execute
does
knowwing
good
of
> installed
there
> manager
>
|||Hi Sunny,
It seems, the Administrator has denied access to "Create table" , "Create
Procedure" and "Create View" for your SQL server user using the
DENY statement;
deny create table to <user>
go
deny create procedure to <user>
go
deny create view to <user>
In this case even if you are db_owner for a database you will not able to do
Create table / Create View or Create Procedure.
If required ask your administrator to Grant back those previlages using
GRANT statement.
The below previlages can be denied from a DB_OWNER by administartor;
CREATE FUNCTION
CREATE PROCEDURE
CREATE RULE
CREATE TABLE
CREATE VIEW
BACKUP DATABASE
BACKUP LOG
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:eiDTikBHEHA.324@.tk2msftngp13.phx.gbl...
> Thanks Hari.
> Since I am db_owner, why I am not able to create new store procedure, view
> and table? It gives me error "CREATE TABLE permission denied in database
> 'myTestDB'.
> Your suggestion would be great help.
> "Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
> news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
database.
> role.
details
> of
might
I
> am
access
> execute
> does
> knowwing
> good
> of
in
> there
>

How do I find I am administrator?

Hi Sunny,
1.What is that means. I do not have admin rights to whole server?
Based on the output you fell inside the 'db_owner' role in your database.
This ensure that you can do any activiites inside that database.
But you not in the part of 'SYSADMIN' role, which is the server wide role.
Due to that your SP_HELPLOGINS failed. This command will list the details of
all Logins who can access SQL server.
2.What is that means. I do not have admin rights to whole server?
Yes, You have full access to only ur database.
3.Is package admin is different than server adminn?
Yes, While saving the package you can mention a Owner password. That might
be needed while accessing the exiting package.
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
> "Hari" <hari_prasad_k@.hotmail.com> wrote in message
> news:#CzPhl4GEHA.3772@.TK2MSFTNGP12.phx.gbl...
SQL
> I selected MyTestDB and ran the store proc and it returns 3 records,
> extracts from the query results:
> GroupName DefDBName
> db_owner master
> db_accessadmin master
> db_ddladmin master
> I believe I have admin rights to MyTestDb.
> Then I selected master database and ran same sp. I got message "User does
> not have permission to perform this action."
> What is that means. I do not have admin rights to whole server?
> the
> Is package admin is different than server adminn?
> Thank you very much for providing detail information.
> SQL
installed
> admin
> change
> any
manager
> on
>
Thanks Hari.
Since I am db_owner, why I am not able to create new store procedure, view
and table? It gives me error "CREATE TABLE permission denied in database
'myTestDB'.
Your suggestion would be great help.
"Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
> Hi Sunny,
> 1.What is that means. I do not have admin rights to whole server?
> Based on the output you fell inside the 'db_owner' role in your database.
> This ensure that you can do any activiites inside that database.
> But you not in the part of 'SYSADMIN' role, which is the server wide
role.
> Due to that your SP_HELPLOGINS failed. This command will list the details
of
> all Logins who can access SQL server.
> 2.What is that means. I do not have admin rights to whole server?
> Yes, You have full access to only ur database.
> 3.Is package admin is different than server adminn?
> Yes, While saving the package you can mention a Owner password. That might
> be needed while accessing the exiting package.
> Thanks
> Hari
> MCDBA
>
> "Sunny" <sunny_1178@.hotmail.com> wrote in message
> news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
am
> SQL
execute
does
knowwing
good
of
> installed
there
> manager
>
|||Hi Sunny,
It seems, the Administrator has denied access to "Create table" , "Create
Procedure" and "Create View" for your SQL server user using the
DENY statement;
deny create table to <user>
go
deny create procedure to <user>
go
deny create view to <user>
In this case even if you are db_owner for a database you will not able to do
Create table / Create View or Create Procedure.
If required ask your administrator to Grant back those previlages using
GRANT statement.
The below previlages can be denied from a DB_OWNER by administartor;
CREATE FUNCTION
CREATE PROCEDURE
CREATE RULE
CREATE TABLE
CREATE VIEW
BACKUP DATABASE
BACKUP LOG
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:eiDTikBHEHA.324@.tk2msftngp13.phx.gbl...
> Thanks Hari.
> Since I am db_owner, why I am not able to create new store procedure, view
> and table? It gives me error "CREATE TABLE permission denied in database
> 'myTestDB'.
> Your suggestion would be great help.
> "Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
> news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
database.
> role.
details
> of
might
I
> am
access
> execute
> does
> knowwing
> good
> of
in
> there
>

How do I find I am administrator?

Hi Sunny,
1.What is that means. I do not have admin rights to whole server?
Based on the output you fell inside the 'db_owner' role in your database.
This ensure that you can do any activiites inside that database.
But you not in the part of 'SYSADMIN' role, which is the server wide role.
Due to that your SP_HELPLOGINS failed. This command will list the details of
all Logins who can access SQL server.
2.What is that means. I do not have admin rights to whole server?
Yes, You have full access to only ur database.
3.Is package admin is different than server adminn?
Yes, While saving the package you can mention a Owner password. That might
be needed while accessing the exiting package.
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
> "Hari" <hari_prasad_k@.hotmail.com> wrote in message
> news:#CzPhl4GEHA.3772@.TK2MSFTNGP12.phx.gbl...
SQL
> I selected MyTestDB and ran the store proc and it returns 3 records,
> extracts from the query results:
> GroupName DefDBName
> db_owner master
> db_accessadmin master
> db_ddladmin master
> I believe I have admin rights to MyTestDb.
> Then I selected master database and ran same sp. I got message "User does
> not have permission to perform this action."
> What is that means. I do not have admin rights to whole server?
> the
> Is package admin is different than server adminn?
> Thank you very much for providing detail information.
> SQL
installed
> admin
> change
> any
manager
> on
>
Thanks Hari.
Since I am db_owner, why I am not able to create new store procedure, view
and table? It gives me error "CREATE TABLE permission denied in database
'myTestDB'.
Your suggestion would be great help.
"Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
> Hi Sunny,
> 1.What is that means. I do not have admin rights to whole server?
> Based on the output you fell inside the 'db_owner' role in your database.
> This ensure that you can do any activiites inside that database.
> But you not in the part of 'SYSADMIN' role, which is the server wide
role.
> Due to that your SP_HELPLOGINS failed. This command will list the details
of
> all Logins who can access SQL server.
> 2.What is that means. I do not have admin rights to whole server?
> Yes, You have full access to only ur database.
> 3.Is package admin is different than server adminn?
> Yes, While saving the package you can mention a Owner password. That might
> be needed while accessing the exiting package.
> Thanks
> Hari
> MCDBA
>
> "Sunny" <sunny_1178@.hotmail.com> wrote in message
> news:OupOe69GEHA.1368@.TK2MSFTNGP11.phx.gbl...
am
> SQL
execute
does
knowwing
good
of
> installed
there
> manager
>
|||Hi Sunny,
It seems, the Administrator has denied access to "Create table" , "Create
Procedure" and "Create View" for your SQL server user using the
DENY statement;
deny create table to <user>
go
deny create procedure to <user>
go
deny create view to <user>
In this case even if you are db_owner for a database you will not able to do
Create table / Create View or Create Procedure.
If required ask your administrator to Grant back those previlages using
GRANT statement.
The below previlages can be denied from a DB_OWNER by administartor;
CREATE FUNCTION
CREATE PROCEDURE
CREATE RULE
CREATE TABLE
CREATE VIEW
BACKUP DATABASE
BACKUP LOG
Thanks
Hari
MCDBA
"Sunny" <sunny_1178@.hotmail.com> wrote in message
news:eiDTikBHEHA.324@.tk2msftngp13.phx.gbl...
> Thanks Hari.
> Since I am db_owner, why I am not able to create new store procedure, view
> and table? It gives me error "CREATE TABLE permission denied in database
> 'myTestDB'.
> Your suggestion would be great help.
> "Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
> news:eVNtu1$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
database.
> role.
details
> of
might
I
> am
access
> execute
> does
> knowwing
> good
> of
in
> there
>