public server role

In exploring permissions that users have, I find that they all have VIEW ANY DATABASE permission which they inherit from the public server role. You can see this by selecting the Permissions page on the Server Properties dialog and highlighting "public". The permission shows as having been granted by sa. This is listed as a server role. However, it does not show in the list of server roles and I can't find any documentation for it (RTM BOL). Interestingly, if I revoke this permission (which is the only permission this role has), the public server role disappears from view. But I can subsequently regrant the permission with Transact-SQL in master and the role comes back.

I would like more information about this role. It seems to be sort of "secret".

When I revoke the permission, users can't see any databases except master and tempdb (both of which have active guest users) even though they have been granted access to other databases.

What I was trying to accomplish by changing this permission was to allow a user to see only those databases which they are allowed to use. But that does not seem to be possible.

Thanks for the help.

Sharon

All logins belong to the public server role. It's like the "Everyone" group in Windows. There is a bug filed against Management Studio for not displaying this role in the list of fixed server roles.

The VIEW ANY DATABASE permission is assigned to public for backward compatibility with SQL Server 2000.

Here are a couple of BOL articles that mention this role:

http://msdn2.microsoft.com/en-us/library/ms175892(SQL.90).aspx

http://msdn2.microsoft.com/en-us/library/ms187096(SQL.90).aspx

Thanks
Laurentiu

|||

The role does not show in sp_helpsrvrole, either. I didn't have time to look for an appropriate catalog view, so there may be one that shows it.

Sharon

|||

Catalogs show it: sys.server_principals.

You can see the permissions granted to it in sys.server_permissions.

Thanks
Laurentiu

Public role and guest security concern in SQL 2000 SP4

Hi all,

I have setup a new SQL 2000 SP4 and internal auditor query about revoke permission from Public role and remove guest from all databases.

1. Can I revoke all default permissions (select on system tables in all DBs) from "Public" role? I am concern any error after such action.

2. I found that guest account in DB -- master, tempdb and msdb. According to Microsoft documents. The account should not remove and can't from master and tempdb. How about msdb?

Thanks,

Regards,

Edwin

1. You may of course get errors from users trying to access system tables without being specifically granted access. You can resolve these issues by granting access to those users.

2. guest cannot be actually dropped - it can only be denied access to the database (hasdbaccess will show as 0). The msdb database is used by replication and SQL agent, among other components. You should check on the respective forums to see the impact of disabling guest access to the msdb database: SQL Server Replication and SQL Server Tools General.

Thanks
Laurentiu

|||

Thanks Laurentiu.

1. I have a search on web, some people mentioned that if revoke the default privilege from "Public" role on DBs (inclu. select system table, execute stored proc.). Microsoft wouldn't support my issues on this SQL in future. Is it true?

Thanks!

Edwin

|||

Microsoft may not be able to provide support if the user directly modifies system tables. Since all you are doing is changing permissions, your product will still be supported. Keep in mind that some features may require "public" to function properly. I can't think of any off the top of my head so once you come up with this locked down configuration you will have to do some verification testing to ensure that the functionality that you require works.

|||

As long as the changes that you make are made using documented features (revoking a permission using REVOKE statement is a documented feature), then you don't have to worry about invalidating your support options.

You should avoid making changes using undocumented techniques, such as, for example, directly updating system tables.

Thanks
Laurentiu

Public permissions

Why is the Public group granted permission to the systables in my database?
Is it safe to remove the select permission from all the sys tables?"Mike" <annon@.hotmail.com> wrote in message
news:OzWZVzbGFHA.2412@.TK2MSFTNGP14.phx.gbl...
> Why is the Public group granted permission to the systables in my
database?
> Is it safe to remove the select permission from all the sys tables?
>
Think of "public" as the "everyone" group in NT. It allows the basic,
minimum permissions to the database. Read the following for a better
understanding:
http://www.microsoft.com/technet/pr...s/c05ppcsq.mspx
You can remove the select permission from public, be aware that this may
cause other issues with stored procedures, etc.
Steve|||SQL Server uses the system tables internally for some
functions and that's why public has permissions on these
tables. There are functions such as resolving names using
internal ids stored in the system tables. And what
permissions are needed on which tables gets further
complicated by what data access mechanisms are used by what
drivers or providers using what applications or tools. Can
you remove them across the board and not have any problems?
Across the board...no. And it's no simple task to go through
and figure or what can and can't be changed.
-Sue
On Wed, 23 Feb 2005 10:30:33 -0500, "Mike"
<annon@.hotmail.com> wrote:

>Why is the Public group granted permission to the systables in my database?
>Is it safe to remove the select permission from all the sys tables?
>