Introduction
The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user’s work session. The user options option allows you to change the default values of the SET options (if the server’s default settings are not appropriate).
It is recommended that, user options database flag for Cloud SQL SQL Server instance should not be configured.
Having a single global configuration for users prevents granular options from being assigned to users. Although not directly a security problem, any security related settings that may have been established for specific users are going to be overwritten due to the current misconfiguration. This misconfiguration can potentially lower the overall security of the database instance.
Steps to disable the “user options” flag using Google Cloud UI
-
Login to GCP and navigate to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances
-
Select the SQL Server for which you want to configure the database flag
-
Click on Edit button.
-
Scroll down to the Flags and parameters section
-
If user options flag is present then click the delete bin icon next to user options flag shown.
-
Click on Save button.
-
Confirm the changes under Database flags and parameters under Configuration section on the Overview page.
Riyaz Walikar
Founder & Chief of R&D
Riyaz is the founder and Chief of R&D at Kloudle, where he hunts for cloud misconfigurations so developers don’t have to. With over 15 years of experience breaking into systems, he’s led offensive security at PwC and product security across APAC for Citrix. Riyaz created the Kubernetes security testing methodology at Appsecco, blending frameworks like MITRE ATT&CK, OWASP, and PTES. He’s passionate about teaching people how to hack—and how to stay secure.
Riyaz Walikar
Founder & Chief of R&D
Riyaz is the founder and Chief of R&D at Kloudle, where he hunts for cloud misconfigurations so developers don’t have to. With over 15 years of experience breaking into systems, he’s led offensive security at PwC and product security across APAC for Citrix. Riyaz created the Kubernetes security testing methodology at Appsecco, blending frameworks like MITRE ATT&CK, OWASP, and PTES. He’s passionate about teaching people how to hack—and how to stay secure.