EEE SQL Query Executor

As of EEE version 1.84.09 a new SQL Query Executor function is available within EEE.

This screen allows users to run ad-hoc T-SQL queries against the EEE database using an appropriate SQL authentication credential.

Although EEE issue warnings if the query text contains specific keywords, EEE does not analyse the syntax of the query nor attempt to prevent execution of destructible queries.

As such, the following security considerations are recommended:

• Disable the screen for all but specific users who have knowledge of creating and running T-SQL queries. This can be done via user privileges.
• Set up the SQL authentication login with the minimum permissions required (see below).
• Use a complex password for the SQL login in order to improve security.

SQL Login Permissions

How to restrict access to the SQL login via permissions

Deny visibility of other databases

Initially run the following as a privileged user to hide other database names to logins using the public server role.

USE MASTER GO DENY VIEW ANY DATABASE TO PUBLIC GO

Server roles

Never grant the sysadmin server role to an SQL login intended for use with the SQL Query Executor page. This would yield unrestricted access on the SQL server to the login.

User Mapping

The SQL login must only be mapped to as a user on the appropriate EEE database. This will restrict the user from accessing other databases. e.g.

Database role membership

We recommend only