How to restrict evil create scripts?

Hi,
For a service I'm working on I need to ask the user for their database
create script. It's used to re-create the users database schema in a
temporary database on a in-house server in an automated fashion.
For security reasons, I need to be sure that the create script can only
create tables, columns etc and not things like snooping in other
databases and/or formatting the server.
Can you give me pointers about what the minimum grants are to let good
script execute successfully and evil scripts fail?
Regards,
Ward
Ward Bekker
"Asp.Net Discussions for the Professional Developer"
http://www.dotnettaxi.com
"Free .Net 2.0 C# to/from VB.Net Code Converter"
http://www.dotnettaxi.com/Tools/Converter.aspxI would consider using Virtual Server isolation.
Set up a virtual server, save copies of the vhd/vmc files (set the file
properties to read only), and then each time you have such a script, use a
virtualized environment and 'evil' scripts won't have anything to sniff
around it.
When finished, just delete the VM.
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
"Ward Bekker" <ward@.NospaaMequanimity.nl> wrote in message
news:eb7es3$c9a$1@.news.cistron.nl...
> Hi,
> For a service I'm working on I need to ask the user for their database
> create script. It's used to re-create the users database schema in a
> temporary database on a in-house server in an automated fashion.
> For security reasons, I need to be sure that the create script can only
> create tables, columns etc and not things like snooping in other databases
> and/or formatting the server.
> Can you give me pointers about what the minimum grants are to let good
> script execute successfully and evil scripts fail?
> Regards,
> Ward
>
> --
> Ward Bekker
> "Asp.Net Discussions for the Professional Developer"
> http://www.dotnettaxi.com
> "Free .Net 2.0 C# to/from VB.Net Code Converter"
> http://www.dotnettaxi.com/Tools/Converter.aspx|||Hi Arnie,
Interesting approach. Is great as a "second line" of defense. SQL Server
can have advanced security configuration, so I was wondering what could
be done in that level. Do you have any idea's about how that?
Thank you,
Ward
Arnie Rowland wrote:
> I would consider using Virtual Server isolation.
> Set up a virtual server, save copies of the vhd/vmc files (set the file
> properties to read only), and then each time you have such a script, use a
> virtualized environment and 'evil' scripts won't have anything to sniff
> around it.
> When finished, just delete the VM.
>