Re: Restrict access to SQL database through ODBC
From: Morris Lewis (Morris@Holistech.com)
Date: 06/30/02
- Next message: Skillman Hunter: "Re: Can web site data be protected from access by the webmasters?"
- Previous message: Morris Lewis: "Re: Where to place SQL Server DMZ, LAN etc."
- In reply to: Chris Goddard: "Restrict access to SQL database through ODBC"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Morris Lewis" <Morris@Holistech.com> Date: Sun, 30 Jun 2002 01:57:33 -0500
This situation shows one of the limitations of server security in general.
If SS is available on the network and clients know a valid account and
password (their NT account in this case), they can gain access. Application
roles are the only available solution. Since you don't have that option,
you're stuck. Network authentication options like IPsec and Kerberos won't
help you either. Even checking on the application name won't help because
it's just a parameter in the ODBC connection string.
If your application does set the application name, you can set up a profiler
alert that looks for connections which don't have the right application
name. It's not foolproof by any means, but it will help you catch the people
who don't know to put the application name in the connection string.
Sorry I don't have a better solution.
Morris Lewis
MCDBA, MCSD, MCSE+I, MCT, CTT+
President, Holistech Inc
"Chris Goddard" <cjg@exel.co.uk> wrote in message
news:12bfa01c21ddc$c06c7860$b1e62ecf@tkmsftngxa04...
> I have a third-party (client / server) application which
> requires access through an ODBC DSN to my SQL Server
> database. I would like the user's access to the database
> to be restricted to this application only. Since the app
> is a 3rd party app I cannot use application roles as I
> have no control over the connection and therefore cannot
> run sp_setapprole on that connection.
>
> Is there any way I can use the ODBC data source but hide
> it from other applications such as MSOFFICE which use
> ODBC. I would also like to prevent the user from setting
> up their own ODBC datasources which could point at the
> database server.
>
> Connection is using Integrated Security.
>
> Any advice welcome.
- Next message: Skillman Hunter: "Re: Can web site data be protected from access by the webmasters?"
- Previous message: Morris Lewis: "Re: Where to place SQL Server DMZ, LAN etc."
- In reply to: Chris Goddard: "Restrict access to SQL database through ODBC"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
