SQL Anywhere Studio Security Guide
Keeping Your Data Secure
As database administrator, there are many actions you can take to improve the security of your data. For example, you can:
Change the default user ID and password The default user ID and password for a newly created database is DBA and SQL. You should change this password before deploying the database.
Require long passwords You can set the MIN_PASSWORD_LENGTH public option to disallow short (and therefore easily guessed) passwords.
For information, see MIN_PASSWORD_LENGTH option [database].
Restrict DBA authority You should restrict DBA authority only to users who absolutely require it since it is very powerful. Users with DBA authority can see and do anything in the database.
You may consider giving users with DBA authority two user IDs: one with DBA authority and one without, so they can connect as DBA only when necessary.
Drop external system functions The following external functions present possible security risks: xp_cmdshell, xp_startmail, xp_startsmtp, xp_sendmail, xp_stopmail, and xp_stopsmtp.
The xp_cmdshell procedure allows users to execute operating system commands or programs.
The e-mail commands allow users to have the server send e-mail composed by the user. Malicious users could use either the e-mail or command shell procedures to perform operating-system tasks with authorities other than those they have been given by the operating system. In a security-conscious environment, you should drop these functions.
For information on dropping procedures, see DROP statement.
Protect your database files You should protect the database file, log files, dbspace files, and write files from unauthorized access. Do not store them within a shared directory or volume.
Protect your database software You should similarly protect Adaptive Server Anywhere software. Only give users access to the applications, DLLs, and other resources they require.
Run the database server as a service or a daemon To prevent unauthorized users from shutting down or gaining access to the database or log files, run the database server as a Windows service. On UNIX, running the server as a daemon serves a similar purpose.
For more information, see Running the server outside the current session.
Set ASTMP to a unique directory To make the engine secure on UNIX platforms, set ASTMP to a unique directory, and make the directory read, write, and execute protected against all other users. Doing so forces all connections to use TCP/IP, which is more secure than the shared memory connection.
Strongly encrypt your database Strongly encrypting your database makes it completely inaccessible without the key. You cannot open the database, or view the database or transaction log files using any other means.
For more information, see -ep server option and -ek database option.