Reveal Password allowed if user is not created
Hi,
We are finding that if we do not have a user specifically created in the Remote Desktop Manager "User and Security Management" to disallow the "reveal password option", they are able to view passwords. Our SQL server authenticates with an Active Directory group, but it does not appear that we can specify these rights at a group level to ensure that users don't default to being able to view the passwords.
Is this a known issue in this version? (We are currently running 8.0.5.0)
Thanks,
Tim
All Comments (1)
Hello,
What permissions have you granted these users at the SQL Server level?
If they have the allow reveal password privilege without having a corresponding user account created, this normally means that they administrators at the DB level.
The most secure topology is one where the user does not have access to the DB at all, meaning with our RDMS/RDMO products.
You can also achieve that while connecting to SQL Server or MySQL, but without knowing the password being used. This is achieved by an administrator creating the account, then creating a data source registration and locking it, thereby hiding the password. RDM is able to connect, but not the user.
Whenever a user has access to the DB, he can poke around and find out information that makes it easier to try to get unauthorized access, i.e. list of usernames. Remember though that passwords are always encrypted.
Maurice