|
Hello, We are looking into several security concerns, and we are wondering if it would be possible to disable the creation of a backup of a Sybase SQL Anywhere 11.0.1 database. We currently often use DBBackup.exe to create a backup of a database. However, there are some databases running in the field where we would like to block this possibility from any user. I have found in the Authorities of a user the checkbox "backup" "required to perform database backups", however think that the DBA also has this possibility. Would it be possible to block this from the DBA aswell, or have a database without a DBA user ? (that last doesn't seem possible) Kind regards, Michael |
|
By definition DBA can do anything - they are the owner of the database. I don't think that a database could exist without one. I suspect the answer to your problem is to ensure that the DBA password is NEVER distributed and that clients in the field connect with a lower level of authority. You may also want to look at database encryption so that the database file cannot be hacked directly. 1
Well, we do use databases without a DBA (actually still with a DBA, however the DBA user has not password and cannot connect anymore - just like these particular SYS and dbo users), but these are SQL remote databases, and they can "re-gain" a DBA "from outside" by means of passthough mode. Something similar might be possible with MobiLink clients (but I'm not sure). So that's a very particular situation. For a single database, I don't think it even makes sense to drop any user with DBA priviledge - you would not be able to alter anything general afterwards... FWIW, I just tested with the v12 demo: You are able to revoke the DBA priviledge from a DBA user, and she cannot do backup afterwards (unless the BACKUP priviledge is set explicitly). However, as stated, you won't be able to change the back if there's no other user with DBA priviledge...
(20 Jan '12, 06:58)
Volker Barth
|
|
Some suggestions:
That may rather limit your possibilities... |
FWIW, revoking BACKUP priviledge from DBA (which a DBA doesn't have been granted by default) doesn't prevent them from doing backups at all - the DBA priviledge seems to contain BACKUP and VALIDATE by design...
A database for which the end users have access to a user id with DBA privilege has no security whatsoever, and preventing a backup will not improve the situation.