---
title: "Turn off database features that reach the · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/operations/server-file-access
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn off database features that reach the server

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Operations](https://agentwranglers.se/playbook/data/operations.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: DAT-59
- Level: Recommended
- Chapter: [Operations](https://agentwranglers.se/playbook/data/operations)
- Rule: Give no app or staff role the power to read files, write files or run programs on the database server. Turn off the features that allow it.
- How: A role with these powers turns one injected query into control of the machine. In PostgreSQL, grant no role `pg_read_server_files`, `pg_write_server_files` or `pg_execute_server_program`. The PostgreSQL docs warn that these roles could be used to gain superuser access. Keep superuser for the one admin role, never the app. In MySQL and MariaDB, give no user the `FILE` privilege, and run `mysql_secure_installation` to remove default accounts and databases. In SQL Server, turn off `xp_cmdshell` and CLR execution. Run the database service as its own low-privilege system user. The app's own grants follow [Give the app a least-privilege database user](https://agentwranglers.se/playbook/data/operations/app-database-role). Default passwords follow [Remove defaults and samples](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/remove-defaults).
- Check: The queries below return only the one admin role in PostgreSQL, and only `root` in MySQL. In SQL Server, `xp_cmdshell` and `clr enabled` both show 0 in `sys.configurations`.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### SQL example

```sql
-- PostgreSQL: roles that are superuser or can reach the server's files and programs
SELECT r.rolname FROM pg_roles r
WHERE r.rolsuper
   OR pg_has_role(r.oid, 'pg_read_server_files', 'MEMBER')
   OR pg_has_role(r.oid, 'pg_write_server_files', 'MEMBER')
   OR pg_has_role(r.oid, 'pg_execute_server_program', 'MEMBER');
-- MySQL: users with the FILE privilege
SELECT user, host FROM mysql.user WHERE File_priv = 'Y';
```

### Shell example

```sh
# SQL Server: expect 0 for both
sqlcmd -Q "SELECT name, value_in_use FROM sys.configurations WHERE name IN ('xp_cmdshell', 'clr enabled')"
```

## Sources

- [OWASP Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html)
- [PostgreSQL predefined roles](https://www.postgresql.org/docs/current/predefined-roles.html)

## Related rules

- [Give the app a least-privilege database user](https://agentwranglers.se/playbook/data/operations/app-database-role) in Data
- [Remove defaults and samples](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/remove-defaults) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data/operations/server-file-access">Agent Wranglers data playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Upgrade the database before its support ends](https://agentwranglers.se/playbook/data/operations/supported-versions)
- Next: [Log in to the database with SCRAM instead of MD5](https://agentwranglers.se/playbook/data/operations/database-scram-auth)
- [Operations](https://agentwranglers.se/playbook/data/operations)