SQL Server Security 1

[mikepotts]

We run a bureau service to our clients hosting their marketing databases, my problem is that Multiple clients databases are hosted on the same server. They can therefore see the names of each others databases although not acutally access them. This is a security breach in terms of client confidentiallity. Is their a way to restrict a person logging in to only see the databases they have access to and not the full list on the server? I presume it is somethiing to do with restricting permissions on the guest user?

I would appreciate any help anyone can give.

 

[Niv3k]

How are they logging in? Is it through SQL Enterprise Manager, or is it an ODBC connection?

 

[tlbroadbent]

The only databases that can be restricted are the system databases. And that is only in Enterprise Manager.

All users can see all other databases. If you've setup security properly they won't be able to view data or objects in databases unless granted access.

You should make sure that the guest login is removed from all databases except master and tempdb. Also, make certain that users are not setup except in the databases they should access.

If a contractual agreement requires that users can’t see other user databases, you'll need to set them up on different servers. With SQL 2000 Enterprise Edition, you can run multiple instances of SQL Server on the same server. Terry Broadbent

"The greatest obstacle to discovery is not ignorance -- it is the illusion of knowledge." - Daniel J Boorstin