October 3, 2007 at 8:37 pm
Hi,
our web application admins need to manage all the exisiting web databases and also need to create databases from time to time.
They were granted sysadmin role by our former sql dba. I would like to tighten the security.
My plan is to give them db_ower role in all the existing web dbs and dbcreator + securityadmin server roles.
My questions are:
1. can dbcreator members manage databases that were created by them?
2. is this proper way from the security perspective.
thanks,
Sherry
October 3, 2007 at 8:48 pm
1. Yes.
2. No.
The reason for #2 being no is that from a security perspective, there is the Principle of Least Privilege. This principle says that you give only the rights that are necessary and no more. When you say manage a database, what exactly do you mean? Do you mean creating objects? Changing permissions? You try to lock down to what exactly is needed. Typically, db_owner is not needed.
Also, are we talking about development or production? In production, rules should be even more stringent. Also, database creation should be controlled for obvious reasons (someone could run the server out of disk space, for instance).
K. Brian Kelley
@kbriankelley
October 3, 2007 at 9:25 pm
Thank Brain.
I think you are right. and that's what I am trying to do. I will discuss with them.
October 3, 2007 at 9:29 pm
Sorry for the typo.
Thanks Brian.
Yes, it's production environment. but sometime they might create test databases on the old server before.
Sherry
October 9, 2007 at 4:23 pm
If it's production, they shouldn't create test databases. If they need to copy over the production database for testing, create them a database, and let them have rights to restore there.
I keep database creation rights tightly held on a production system. Let them have free-reign on their own systems or development, but not production.
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply