Securing a web DB

From: Murali (diffs@vsnl.com)
Date: 11/29/02 

From: "Murali" <diffs@vsnl.com>
Date: Fri, 29 Nov 2002 12:48:16 +0530

Hi,

We are putting up a ASP.NET based web site using SQL Server database.

Users of the web site get to see confidential data. All of them have to
login to look at data.
Eventually the site will be SSLed to protect it from password hacking.

The way the s/w is designed currently is to read the connection string (db
name, uid, password) from an XML file and establish connection to the DB.

We are planning to host the site with as ISP.
One of the requirements is that the ISP should not be able to "easily"
access the SQL database.
Firstly, we are planning to use SQL server authentication (and not Win 2K
integrated login) for the database.
We want to ensure that the Web host administrator does not read XML file and
get to know the SQL server password.
One suggestion is to encrypt the password (or connect string) and store this
in XML.

What do others do in these situations ? Any ideas / URLs are welcome

Murali 

--
Differentiated Software Solutions Pvt. Ltd.,
90, 3rd Cross,2nd Main,
Ganga Nagar,
Bangalore - 560 032
Phone : 91 80 3631445, 3431470
Visit us at www.diffsoft.com

Relevant Pages

  • Securing a web DB
    ... We are putting up a ASP.NET based web site using SQL Server database. ... Users of the web site get to see confidential data. ...
    (comp.security.misc)
  • Re: Securing a web DB
    ... >We are putting up a ASP.NET based web site using SQL Server database. ... >name, uid, password) from an XML file and establish connection to the DB. ...
    (microsoft.public.sqlserver.security)
  • Re: database
    ... Maybe you should use a "for dummies" database: ... Kevin Spencer ... >> Okay, so where is the SQL Server located, with respect to the web site? ...
    (microsoft.public.frontpage.client)
  • Re: No db access after publishing web site
    ... Is the SQL Server Express database in the new application's App_Data folder? ... But after I published the web site in a file system ...
    (microsoft.public.dotnet.framework.aspnet)
  • ASP.NET Web Site Administration Tool
    ... I'm developing a Web site with VS 2005 on a machine under Windows ... When I try to access the Security tab in the Web Site Administration ... it fails with a message "Unable to connect to SQL Server ... The database aspnetdb is attached, and my user login, which is in a ...
    (microsoft.public.dotnet.framework.aspnet)