I have a business directory software done in vb.net and sqlserver .We are
using msde for distribution purpose .The problem we are facing is about the
security of the data . The cd goes to common man and we are concerned about
the security of the data.Is there any option where we can ensure that the
database cannot be opened by the user . please help
..Urgent.........................
If by "common man" you mean that the database is installed on each
person's computer in their own MSDE instance, then the answer is no,
you can't prevent them from getting at the data because they are a
system administrator on that instance. If the database is located on a
server, then it is possible to implement a more robust security scheme
since users can be prevented from accessing the physical files and
from connecting as system administrators.
--Mary
On Thu, 8 Sep 2005 13:33:01 -0700, "techiebose"
<techiebose@.discussions.microsoft.com> wrote:
>I have a business directory software done in vb.net and sqlserver .We are
>using msde for distribution purpose .The problem we are facing is about the
>security of the data . The cd goes to common man and we are concerned about
>the security of the data.Is there any option where we can ensure that the
>database cannot be opened by the user . please help
>.Urgent.........................
sql
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Monday, March 26, 2012
MSDE Security. Oxymoron?
We have a commercial application that uses a number of Access DBs. For security reasons we have to encrypt all the data. It's not personal data or anything, just proprietary information.
I've been thinking about MSDE instead of Access so I could stop encrypting. Since the user will only get MSDE they won't be able to get the data without our application since they won't know the user or pwd. Unless...
If they already have the full SQL Server on some other system, couldn't they just copy the MDF file from our application to that server, attach it as a new DB and have full access to it (using the admin account on the full system?)
I guess it comes down to can an MSDE database be read on a full SQL Server instance elsewhere?The scenario you describe is correct. The users would have to stop the SQL Services (no big challenge for most folks), in order to ensure they get a nice clean copy. They can even probably access the data with the SQL tools if they are a local admin on the MSDE machine (unless you removed the BUILTIN\ADMINISTRATORS group).
You may just want to go for the full fledged version of SQL Server, and put the server in a locked server room, with no user permissions on the data and backup directories.
I've been thinking about MSDE instead of Access so I could stop encrypting. Since the user will only get MSDE they won't be able to get the data without our application since they won't know the user or pwd. Unless...
If they already have the full SQL Server on some other system, couldn't they just copy the MDF file from our application to that server, attach it as a new DB and have full access to it (using the admin account on the full system?)
I guess it comes down to can an MSDE database be read on a full SQL Server instance elsewhere?The scenario you describe is correct. The users would have to stop the SQL Services (no big challenge for most folks), in order to ensure they get a nice clean copy. They can even probably access the data with the SQL tools if they are a local admin on the MSDE machine (unless you removed the BUILTIN\ADMINISTRATORS group).
You may just want to go for the full fledged version of SQL Server, and put the server in a locked server room, with no user permissions on the data and backup directories.
MSDE security (still confused!)
I am distributing my application which includes MSDE 2000. My setup program
attaches .MDF and .LDF files once instance of MSDE 2000 is installed on the
customer’s computer. Now my worry is how can I restrict customers running W2k
or XP from accessing my database using EM or third party GUI’s. If customers
are running W2k or XP and have administrative privileges they can easily
register the installed instance of MSDE with EM and access the data
structure, stored proc etc?
I tested it on a computer which is running W2k, I logged in as
Administrator, ran my Setup program to install MSDE, attach .MDF and .LDF,
..NET framework, MDAC and my application. Then I installed EM and registered
an instance of installed MSDE with it. I could access everything in the
attached db.
How can I prevent this, as data structure, stored proc etc means a lot and
can’t let anyone steal it.
Thanks
Hi Job,
You're not going to like the answer but you can't. If the user has admin
privileges on the system, you can't keep them out. You can make it difficult
for them but you can't actually keep them out. There are many things they
can do to get back in.
You might need to look at encrypting your stored procs (ie create them WITH
ENCRYPTION). That at least might be a start.
HTH,
Greg Low [MVP]
MSDE Manager SQL Tools
www.whitebearconsulting.com
"Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
news:1AACA558-6859-43A6-BF6B-0550D0F7750C@.microsoft.com...
>I am distributing my application which includes MSDE 2000. My setup program
> attaches .MDF and .LDF files once instance of MSDE 2000 is installed on
> the
> customer's computer. Now my worry is how can I restrict customers running
> W2k
> or XP from accessing my database using EM or third party GUI's. If
> customers
> are running W2k or XP and have administrative privileges they can easily
> register the installed instance of MSDE with EM and access the data
> structure, stored proc etc?
> I tested it on a computer which is running W2k, I logged in as
> Administrator, ran my Setup program to install MSDE, attach .MDF and .LDF,
> .NET framework, MDAC and my application. Then I installed EM and
> registered
> an instance of installed MSDE with it. I could access everything in the
> attached db.
> How can I prevent this, as data structure, stored proc etc means a lot and
> can't let anyone steal it.
> Thanks
>
|||That was the last thing I wanted to hear. What’s the point of having windows
authentication in first place, when its will leave your database system
vulnerable. Why MS has designed it this way, where does all security features
goes? How can you ensure that you are designing robust and secure database
system? Imagine you spending weeks on designing your database system to find
out that there’s no secured way to conceal it. I can’t even use Access as I
can’t run stored proc with it? Is there any other better solution available?
"Greg Low [MVP]" wrote:
> Hi Job,
> You're not going to like the answer but you can't. If the user has admin
> privileges on the system, you can't keep them out. You can make it difficult
> for them but you can't actually keep them out. There are many things they
> can do to get back in.
> You might need to look at encrypting your stored procs (ie create them WITH
> ENCRYPTION). That at least might be a start.
> HTH,
>
> --
> Greg Low [MVP]
> MSDE Manager SQL Tools
> www.whitebearconsulting.com
> "Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
> news:1AACA558-6859-43A6-BF6B-0550D0F7750C@.microsoft.com...
>
>
|||"Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
news:3D7C097D-4567-46DA-9C98-29139C6B5FAF@.microsoft.com...
> That was the last thing I wanted to hear. What's the point of having
windows
> authentication in first place, when its will leave your database system
> vulnerable. Why MS has designed it this way, where does all security
features
> goes? How can you ensure that you are designing robust and secure database
> system? Imagine you spending weeks on designing your database system to
find
> out that there's no secured way to conceal it. I can't even use Access as
I
> can't run stored proc with it? Is there any other better solution
available?
A logical move would be from MSDE to SQL Server running on a server
platform. While similar issues exist with folks that have local
administrative access, you can lock down your instance of SQL Server fairly
tightly. Combine that with stored procedure encryption and possibly, file
level encryption you should be able to go a long way to protect your
intellectual investment.
Steve
attaches .MDF and .LDF files once instance of MSDE 2000 is installed on the
customer’s computer. Now my worry is how can I restrict customers running W2k
or XP from accessing my database using EM or third party GUI’s. If customers
are running W2k or XP and have administrative privileges they can easily
register the installed instance of MSDE with EM and access the data
structure, stored proc etc?
I tested it on a computer which is running W2k, I logged in as
Administrator, ran my Setup program to install MSDE, attach .MDF and .LDF,
..NET framework, MDAC and my application. Then I installed EM and registered
an instance of installed MSDE with it. I could access everything in the
attached db.
How can I prevent this, as data structure, stored proc etc means a lot and
can’t let anyone steal it.
Thanks
Hi Job,
You're not going to like the answer but you can't. If the user has admin
privileges on the system, you can't keep them out. You can make it difficult
for them but you can't actually keep them out. There are many things they
can do to get back in.
You might need to look at encrypting your stored procs (ie create them WITH
ENCRYPTION). That at least might be a start.
HTH,
Greg Low [MVP]
MSDE Manager SQL Tools
www.whitebearconsulting.com
"Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
news:1AACA558-6859-43A6-BF6B-0550D0F7750C@.microsoft.com...
>I am distributing my application which includes MSDE 2000. My setup program
> attaches .MDF and .LDF files once instance of MSDE 2000 is installed on
> the
> customer's computer. Now my worry is how can I restrict customers running
> W2k
> or XP from accessing my database using EM or third party GUI's. If
> customers
> are running W2k or XP and have administrative privileges they can easily
> register the installed instance of MSDE with EM and access the data
> structure, stored proc etc?
> I tested it on a computer which is running W2k, I logged in as
> Administrator, ran my Setup program to install MSDE, attach .MDF and .LDF,
> .NET framework, MDAC and my application. Then I installed EM and
> registered
> an instance of installed MSDE with it. I could access everything in the
> attached db.
> How can I prevent this, as data structure, stored proc etc means a lot and
> can't let anyone steal it.
> Thanks
>
|||That was the last thing I wanted to hear. What’s the point of having windows
authentication in first place, when its will leave your database system
vulnerable. Why MS has designed it this way, where does all security features
goes? How can you ensure that you are designing robust and secure database
system? Imagine you spending weeks on designing your database system to find
out that there’s no secured way to conceal it. I can’t even use Access as I
can’t run stored proc with it? Is there any other better solution available?
"Greg Low [MVP]" wrote:
> Hi Job,
> You're not going to like the answer but you can't. If the user has admin
> privileges on the system, you can't keep them out. You can make it difficult
> for them but you can't actually keep them out. There are many things they
> can do to get back in.
> You might need to look at encrypting your stored procs (ie create them WITH
> ENCRYPTION). That at least might be a start.
> HTH,
>
> --
> Greg Low [MVP]
> MSDE Manager SQL Tools
> www.whitebearconsulting.com
> "Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
> news:1AACA558-6859-43A6-BF6B-0550D0F7750C@.microsoft.com...
>
>
|||"Job Lot" <JobLot@.discussions.microsoft.com> wrote in message
news:3D7C097D-4567-46DA-9C98-29139C6B5FAF@.microsoft.com...
> That was the last thing I wanted to hear. What's the point of having
windows
> authentication in first place, when its will leave your database system
> vulnerable. Why MS has designed it this way, where does all security
features
> goes? How can you ensure that you are designing robust and secure database
> system? Imagine you spending weeks on designing your database system to
find
> out that there's no secured way to conceal it. I can't even use Access as
I
> can't run stored proc with it? Is there any other better solution
available?
A logical move would be from MSDE to SQL Server running on a server
platform. While similar issues exist with folks that have local
administrative access, you can lock down your instance of SQL Server fairly
tightly. Combine that with stored procedure encryption and possibly, file
level encryption you should be able to go a long way to protect your
intellectual investment.
Steve
MSDE Security (aka users looking at my apps database)
Is there a way to secure a database on MSDE so that my users cannot be
poking around my applications database? I've been reading up on it and see
that MSDE installs with a mixed security mode.
Does that mean if I secure my database with sql security someone who is an
admin on the machine can look at my database regardless of what I set?
I am concerned that my users (and competition) will try to hack into my
instance and steal my data & data structures so I'm trying to figure out
how I can prevent that. I understand I can encrypt my stored procedure at
least I hope that is still the case with MSDE.
Any thoughts?
Thanks.
This is a desktop app and not a web app btw.
hi Jason,
"Jason" <yo@.yo.com> ha scritto nel messaggio
news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
> This is a desktop app and not a web app btw.
you can only protect stored procedures, views and user define function with
WITH ENCRYPTION in order to hide their text, but for base table you are out
of luck... there's actually non way for preventing sysadmins role members to
dig into your metaschema...
as regard data, that can only be encripted using third parties tools like
http://www.activecrypt.com/index.htm or tools like that
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Hello,
It is also possible to use SQL autentification, then create only one login
that the user doesn't know.
After that, your application connect as the login you 've just created. (for
example Log = marc PWD = marc)
In you database, you make a login table. This table contain the login of the
user and his password, and your application will test this table to see if
the user can connect. With this method you can even forbid a part of the
application or a time to connect ... easily.
For example UID Andre PWD Andre.
After that, your user will enter the login and password to your application
(Andre/ Andre).
your application connect as marc, see if Andre can login and if Andre can
login, your application can work with the user name marc with the database
(and show the user the login Andre)
So your user will never be able to work on the database as his login is not
a database login
Marc Allard
"Jason" <yo@.yo.com> a crit dans le message de
news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
>
> This is a desktop app and not a web app btw.
>
|||The only way you can lock the data down is to encrypt it. If a user has
Local Admin rights in the OS (NT/2K/XP), then they can see the data anyway,
irrespective of SQL Auth as NT Auth is always available.
Administrator ALWAYS gets to the data!
On Fri, 6 Aug 2004 11:05:29 +0200, Allcomp wrote:
[vbcol=seagreen]
> Hello,
> It is also possible to use SQL autentification, then create only one login
> that the user doesn't know.
> After that, your application connect as the login you 've just created. (for
> example Log = marc PWD = marc)
> In you database, you make a login table. This table contain the login of the
> user and his password, and your application will test this table to see if
> the user can connect. With this method you can even forbid a part of the
> application or a time to connect ... easily.
> For example UID Andre PWD Andre.
> After that, your user will enter the login and password to your application
> (Andre/ Andre).
> your application connect as marc, see if Andre can login and if Andre can
> login, your application can work with the user name marc with the database
> (and show the user the login Andre)
> So your user will never be able to work on the database as his login is not
> a database login
> Marc Allard
>
> "Jason" <yo@.yo.com> a crit dans le message de
> news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
|||Hello,
I didn't know it was possible to connect as Administrator in a sql server
when the installation was mado to allow only SQL autentification. How can
you make it?
Thank you
Marc Allard
"Paul Buxton" <psb@.NOSPAMspireite.demon.co.uk> a crit dans le message de
news:1opgizeso0jib$.ywf1zot73zdg.dlg@.40tude.net...
> The only way you can lock the data down is to encrypt it. If a user has
> Local Admin rights in the OS (NT/2K/XP), then they can see the data
anyway,[vbcol=seagreen]
> irrespective of SQL Auth as NT Auth is always available.
> Administrator ALWAYS gets to the data!
> On Fri, 6 Aug 2004 11:05:29 +0200, Allcomp wrote:
login[vbcol=seagreen]
(for[vbcol=seagreen]
the[vbcol=seagreen]
if[vbcol=seagreen]
application[vbcol=seagreen]
can[vbcol=seagreen]
database[vbcol=seagreen]
not[vbcol=seagreen]
see[vbcol=seagreen]
an[vbcol=seagreen]
out[vbcol=seagreen]
at[vbcol=seagreen]
|||hi,
"Allcomp" <fa097770@.nospam.skynet.be> ha scritto nel messaggio
news:41136323$0$296$ba620e4c@.news.skynet.be...
> Hello,
> I didn't know it was possible to connect as Administrator in a sql server
> when the installation was mado to allow only SQL autentification. How can
> you make it?
just log in in Windows as a member of sysadmins; sysadmis are member of
Builtin\Administrator SQL Server role, which has administrative privileges
by default...
the method you previously exposed only prevents user of YOUR application not
to access that data, but using ad-hoc query tools like QA, oSql or simply
Visual Data Manager (VB3 to VB6 <g>) an administrator can perform whatever
activity...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Only One JASON, FORGET IT.
I have been called in more than once to untangle all sorts of developer
installed security, I do it and will continue to do it.
Developers who think that business data should be locked up from the
Business should be locked up themselves. If your data is proprietary,
then I suggest you create your own encrypted storage system! But give up on
trying to lock the rightful owners of data out from it by denying them
access to the database.
Your schema etc. Might be your work, but locking out legitimate uses of
the data is in my opinion about as quick a way to get your application
dumped as you can get. Companies expect to be able to throw a copy of
Crystal Reports onto a machine and interogate the database for the
information that they want, in the manner that they want it, when they want
it.
As foir competitors using your schema in their own products, you must be
joking! They might however write conversion routines to 'upgrade' from your
product. This is a fairly normal business practice.
You sound like Apple complaining about Real Networks, or an IBM salesman
from the 1970s, telling the customer that MS-Dos on a compatible PC is just
not as good as an IBM PC-XT with PC-Dos for running Lotus 1-2-3
Matt
|||hi Matt,
"Unicorn" <unicorn@.somewhere.com> ha scritto nel messaggio
news:epy96HEfEHA.2604@.TK2MSFTNGP12.phx.gbl...
> Only One JASON, FORGET IT.
> I have been called in more than once to untangle all sorts of developer
> installed security, I do it and will continue to do it.
> Developers who think that business data should be locked up from the
> Business should be locked up themselves. If your data is proprietary,
> then I suggest you create your own encrypted storage system! But give up
on
> trying to lock the rightful owners of data out from it by denying them
> access to the database.
not to start a flame, but just a consideration...
I think it really depends... if you "sell" data, that's to say an aggregated
and/or particular kind of sensible data, perhaps having it not accessible to
external application but your(s), could be a legitimated pray for a
particular protection system, and perhaps external encryption is a way to go
for, as you already pointed out... perhaps not the best as it will be not
integrated.. but acceptable...
the same is true for sensible code you provide in form of stored
procedures/udf/views...
let's think about a genious tool, RAC by SQL Server MVP Thanh Ngo (AKA OJ)..
my understanding is it provides a set of stored procedures to manipulate
data, with unique features like CROSSTAB rotations and so on... this is
valuable code and think is provided as encrypted code... as it should
but you actually have no way to protect your metaschema(s) the same way...
even if SQL Server encryption has been defeated... I do personally think
this could be a valuable feature in some scenario...
> Your schema etc. Might be your work, but locking out legitimate uses of
> the data is in my opinion about as quick a way to get your application
> dumped as you can get. Companies expect to be able to throw a copy of
> Crystal Reports onto a machine and interogate the database for the
> information that they want, in the manner that they want it, when they
want
> it.
this could violate certain EULAs and/or rules, both private and/or
legislative...
recently I've been asked to buy a mailing for german (potential)
customers... the selling company provided a well defined license for 1 use,
n uses of the same data... don't know what kind of database they would
provide as our choice went to mailing labels directly, just for one shot...
but this scenario certainly does not grant you the possibility for multi
server analysis and or use...
another issue... think to privacy protection for sensible data... medical
data... there are both european and USA (as other countries too..) acts that
state and (strictly) discipline the use of this kind of data...
a recent article by Sean Maloney on SQL Server Magazine
(http://www.winnetmag.com/SQLServer/A...731/42731.html for
subscribers only) presents a way to protect data from unlegitimated users
with row level security granularity.. but if you manually bypass that kind
of security (which you can, as a syasdmin) you are elegible for legal
repercussions...
> As foir competitors using your schema in their own products, you must be
> joking! They might however write conversion routines to 'upgrade' from
your
> product. This is a fairly normal business practice.
>
agree =;-D
again... not to flame but just my 2 (euro)cents
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Thank you for your answer
Marc Allard
"Andrea Montanari" <andrea.sqlDMO@.virgilio.it> a crit dans le message de
news:2nhjgsFud2mU1@.uni-berlin.de...[vbcol=seagreen]
> hi,
> "Allcomp" <fa097770@.nospam.skynet.be> ha scritto nel messaggio
> news:41136323$0$296$ba620e4c@.news.skynet.be...
server[vbcol=seagreen]
can
> just log in in Windows as a member of sysadmins; sysadmis are member of
> Builtin\Administrator SQL Server role, which has administrative privileges
> by default...
> the method you previously exposed only prevents user of YOUR application
not
> to access that data, but using ad-hoc query tools like QA, oSql or simply
> Visual Data Manager (VB3 to VB6 <g>) an administrator can perform whatever
> activity...
> --
> Andrea Montanari (Microsoft MVP - SQL Server)
> http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
> DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
> (my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
> interface)
> -- remove DMO to reply
>
|||A possible solution may be to use dbLockdown. It will encrypt ALL (or
selected) database object scripts for stored procedures, triggers, user
defined functions and views in your MSDE database using the WITH
ENCRYPTION clause. The tool will also automatically archive the script
source so you can restore it again at any time. Check out
http://www.ecatenate.com/dblockdown_product_info.html
Regards, Simon
"Jason" <yo@.yo.com> wrote in message news:<#4bvqLoeEHA.3016@.tk2msftngp13.phx.gbl>...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
>
> This is a desktop app and not a web app btw.
poking around my applications database? I've been reading up on it and see
that MSDE installs with a mixed security mode.
Does that mean if I secure my database with sql security someone who is an
admin on the machine can look at my database regardless of what I set?
I am concerned that my users (and competition) will try to hack into my
instance and steal my data & data structures so I'm trying to figure out
how I can prevent that. I understand I can encrypt my stored procedure at
least I hope that is still the case with MSDE.
Any thoughts?
Thanks.
This is a desktop app and not a web app btw.
hi Jason,
"Jason" <yo@.yo.com> ha scritto nel messaggio
news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
> This is a desktop app and not a web app btw.
you can only protect stored procedures, views and user define function with
WITH ENCRYPTION in order to hide their text, but for base table you are out
of luck... there's actually non way for preventing sysadmins role members to
dig into your metaschema...
as regard data, that can only be encripted using third parties tools like
http://www.activecrypt.com/index.htm or tools like that
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Hello,
It is also possible to use SQL autentification, then create only one login
that the user doesn't know.
After that, your application connect as the login you 've just created. (for
example Log = marc PWD = marc)
In you database, you make a login table. This table contain the login of the
user and his password, and your application will test this table to see if
the user can connect. With this method you can even forbid a part of the
application or a time to connect ... easily.
For example UID Andre PWD Andre.
After that, your user will enter the login and password to your application
(Andre/ Andre).
your application connect as marc, see if Andre can login and if Andre can
login, your application can work with the user name marc with the database
(and show the user the login Andre)
So your user will never be able to work on the database as his login is not
a database login
Marc Allard
"Jason" <yo@.yo.com> a crit dans le message de
news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
>
> This is a desktop app and not a web app btw.
>
|||The only way you can lock the data down is to encrypt it. If a user has
Local Admin rights in the OS (NT/2K/XP), then they can see the data anyway,
irrespective of SQL Auth as NT Auth is always available.
Administrator ALWAYS gets to the data!
On Fri, 6 Aug 2004 11:05:29 +0200, Allcomp wrote:
[vbcol=seagreen]
> Hello,
> It is also possible to use SQL autentification, then create only one login
> that the user doesn't know.
> After that, your application connect as the login you 've just created. (for
> example Log = marc PWD = marc)
> In you database, you make a login table. This table contain the login of the
> user and his password, and your application will test this table to see if
> the user can connect. With this method you can even forbid a part of the
> application or a time to connect ... easily.
> For example UID Andre PWD Andre.
> After that, your user will enter the login and password to your application
> (Andre/ Andre).
> your application connect as marc, see if Andre can login and if Andre can
> login, your application can work with the user name marc with the database
> (and show the user the login Andre)
> So your user will never be able to work on the database as his login is not
> a database login
> Marc Allard
>
> "Jason" <yo@.yo.com> a crit dans le message de
> news:%234bvqLoeEHA.3016@.tk2msftngp13.phx.gbl...
|||Hello,
I didn't know it was possible to connect as Administrator in a sql server
when the installation was mado to allow only SQL autentification. How can
you make it?
Thank you
Marc Allard
"Paul Buxton" <psb@.NOSPAMspireite.demon.co.uk> a crit dans le message de
news:1opgizeso0jib$.ywf1zot73zdg.dlg@.40tude.net...
> The only way you can lock the data down is to encrypt it. If a user has
> Local Admin rights in the OS (NT/2K/XP), then they can see the data
anyway,[vbcol=seagreen]
> irrespective of SQL Auth as NT Auth is always available.
> Administrator ALWAYS gets to the data!
> On Fri, 6 Aug 2004 11:05:29 +0200, Allcomp wrote:
login[vbcol=seagreen]
(for[vbcol=seagreen]
the[vbcol=seagreen]
if[vbcol=seagreen]
application[vbcol=seagreen]
can[vbcol=seagreen]
database[vbcol=seagreen]
not[vbcol=seagreen]
see[vbcol=seagreen]
an[vbcol=seagreen]
out[vbcol=seagreen]
at[vbcol=seagreen]
|||hi,
"Allcomp" <fa097770@.nospam.skynet.be> ha scritto nel messaggio
news:41136323$0$296$ba620e4c@.news.skynet.be...
> Hello,
> I didn't know it was possible to connect as Administrator in a sql server
> when the installation was mado to allow only SQL autentification. How can
> you make it?
just log in in Windows as a member of sysadmins; sysadmis are member of
Builtin\Administrator SQL Server role, which has administrative privileges
by default...
the method you previously exposed only prevents user of YOUR application not
to access that data, but using ad-hoc query tools like QA, oSql or simply
Visual Data Manager (VB3 to VB6 <g>) an administrator can perform whatever
activity...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Only One JASON, FORGET IT.
I have been called in more than once to untangle all sorts of developer
installed security, I do it and will continue to do it.
Developers who think that business data should be locked up from the
Business should be locked up themselves. If your data is proprietary,
then I suggest you create your own encrypted storage system! But give up on
trying to lock the rightful owners of data out from it by denying them
access to the database.
Your schema etc. Might be your work, but locking out legitimate uses of
the data is in my opinion about as quick a way to get your application
dumped as you can get. Companies expect to be able to throw a copy of
Crystal Reports onto a machine and interogate the database for the
information that they want, in the manner that they want it, when they want
it.
As foir competitors using your schema in their own products, you must be
joking! They might however write conversion routines to 'upgrade' from your
product. This is a fairly normal business practice.
You sound like Apple complaining about Real Networks, or an IBM salesman
from the 1970s, telling the customer that MS-Dos on a compatible PC is just
not as good as an IBM PC-XT with PC-Dos for running Lotus 1-2-3
Matt
|||hi Matt,
"Unicorn" <unicorn@.somewhere.com> ha scritto nel messaggio
news:epy96HEfEHA.2604@.TK2MSFTNGP12.phx.gbl...
> Only One JASON, FORGET IT.
> I have been called in more than once to untangle all sorts of developer
> installed security, I do it and will continue to do it.
> Developers who think that business data should be locked up from the
> Business should be locked up themselves. If your data is proprietary,
> then I suggest you create your own encrypted storage system! But give up
on
> trying to lock the rightful owners of data out from it by denying them
> access to the database.
not to start a flame, but just a consideration...
I think it really depends... if you "sell" data, that's to say an aggregated
and/or particular kind of sensible data, perhaps having it not accessible to
external application but your(s), could be a legitimated pray for a
particular protection system, and perhaps external encryption is a way to go
for, as you already pointed out... perhaps not the best as it will be not
integrated.. but acceptable...
the same is true for sensible code you provide in form of stored
procedures/udf/views...
let's think about a genious tool, RAC by SQL Server MVP Thanh Ngo (AKA OJ)..
my understanding is it provides a set of stored procedures to manipulate
data, with unique features like CROSSTAB rotations and so on... this is
valuable code and think is provided as encrypted code... as it should
but you actually have no way to protect your metaschema(s) the same way...
even if SQL Server encryption has been defeated... I do personally think
this could be a valuable feature in some scenario...
> Your schema etc. Might be your work, but locking out legitimate uses of
> the data is in my opinion about as quick a way to get your application
> dumped as you can get. Companies expect to be able to throw a copy of
> Crystal Reports onto a machine and interogate the database for the
> information that they want, in the manner that they want it, when they
want
> it.
this could violate certain EULAs and/or rules, both private and/or
legislative...
recently I've been asked to buy a mailing for german (potential)
customers... the selling company provided a well defined license for 1 use,
n uses of the same data... don't know what kind of database they would
provide as our choice went to mailing labels directly, just for one shot...
but this scenario certainly does not grant you the possibility for multi
server analysis and or use...
another issue... think to privacy protection for sensible data... medical
data... there are both european and USA (as other countries too..) acts that
state and (strictly) discipline the use of this kind of data...
a recent article by Sean Maloney on SQL Server Magazine
(http://www.winnetmag.com/SQLServer/A...731/42731.html for
subscribers only) presents a way to protect data from unlegitimated users
with row level security granularity.. but if you manually bypass that kind
of security (which you can, as a syasdmin) you are elegible for legal
repercussions...
> As foir competitors using your schema in their own products, you must be
> joking! They might however write conversion routines to 'upgrade' from
your
> product. This is a fairly normal business practice.
>
agree =;-D
again... not to flame but just my 2 (euro)cents
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Thank you for your answer
Marc Allard
"Andrea Montanari" <andrea.sqlDMO@.virgilio.it> a crit dans le message de
news:2nhjgsFud2mU1@.uni-berlin.de...[vbcol=seagreen]
> hi,
> "Allcomp" <fa097770@.nospam.skynet.be> ha scritto nel messaggio
> news:41136323$0$296$ba620e4c@.news.skynet.be...
server[vbcol=seagreen]
can
> just log in in Windows as a member of sysadmins; sysadmis are member of
> Builtin\Administrator SQL Server role, which has administrative privileges
> by default...
> the method you previously exposed only prevents user of YOUR application
not
> to access that data, but using ad-hoc query tools like QA, oSql or simply
> Visual Data Manager (VB3 to VB6 <g>) an administrator can perform whatever
> activity...
> --
> Andrea Montanari (Microsoft MVP - SQL Server)
> http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
> DbaMgr2k ver 0.8.0 - DbaMgr ver 0.54.0
> (my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
> interface)
> -- remove DMO to reply
>
|||A possible solution may be to use dbLockdown. It will encrypt ALL (or
selected) database object scripts for stored procedures, triggers, user
defined functions and views in your MSDE database using the WITH
ENCRYPTION clause. The tool will also automatically archive the script
source so you can restore it again at any time. Check out
http://www.ecatenate.com/dblockdown_product_info.html
Regards, Simon
"Jason" <yo@.yo.com> wrote in message news:<#4bvqLoeEHA.3016@.tk2msftngp13.phx.gbl>...
> Is there a way to secure a database on MSDE so that my users cannot be
> poking around my applications database? I've been reading up on it and see
> that MSDE installs with a mixed security mode.
> Does that mean if I secure my database with sql security someone who is an
> admin on the machine can look at my database regardless of what I set?
> I am concerned that my users (and competition) will try to hack into my
> instance and steal my data & data structures so I'm trying to figure out
> how I can prevent that. I understand I can encrypt my stored procedure at
> least I hope that is still the case with MSDE.
> Any thoughts?
> Thanks.
>
> This is a desktop app and not a web app btw.
msde security - windows mode?
Hi,
I want to be able to use SQL authentication on my local MSDE 2000 , I've
added a user using sp_addlogin, and try to connect using it, however it
always gives me 'not associated with a trusted SQL server connection'. Is
there any way I can force it to go to SQL mode without reinstalling it?
Thanks> I want to be able to use SQL authentication on my local MSDE 2000 , I've
> added a user using sp_addlogin, and try to connect using it, however it
> always gives me 'not associated with a trusted SQL server connection'. Is
> there any way I can force it to go to SQL mode without reinstalling it?
Yes - check the article at http://support.microsoft.com/kb/285097/EN-US/.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com|||> I want to be able to use SQL authentication on my local MSDE 2000 , I've
> added a user using sp_addlogin, and try to connect using it, however it
> always gives me 'not associated with a trusted SQL server connection'. Is
> there any way I can force it to go to SQL mode without reinstalling it?
Look at my answer in .security group.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com
I want to be able to use SQL authentication on my local MSDE 2000 , I've
added a user using sp_addlogin, and try to connect using it, however it
always gives me 'not associated with a trusted SQL server connection'. Is
there any way I can force it to go to SQL mode without reinstalling it?
Thanks> I want to be able to use SQL authentication on my local MSDE 2000 , I've
> added a user using sp_addlogin, and try to connect using it, however it
> always gives me 'not associated with a trusted SQL server connection'. Is
> there any way I can force it to go to SQL mode without reinstalling it?
Yes - check the article at http://support.microsoft.com/kb/285097/EN-US/.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com|||> I want to be able to use SQL authentication on my local MSDE 2000 , I've
> added a user using sp_addlogin, and try to connect using it, however it
> always gives me 'not associated with a trusted SQL server connection'. Is
> there any way I can force it to go to SQL mode without reinstalling it?
Look at my answer in .security group.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com
MSDE security
Hello,
Article Q319930 states that MSDE clients must be members
of the Administrators group on the machine which is
hosting MSDE. Is this really correct? I want to use MSDE
with non-admin clients, and have done the appropriate
sp_grantdbaccess, but still get 'login failed' errors when
using a non-admin account.
No, you can use Windows Auth. from the network not only locally. Did you set
the Auth. mode to mixed mode ? Sound like you ddidnt. Try to connect on the
computer MSDE is running to verify if its turned on via.: (must be in the
local administrators group when logged on)
Commandprompt: OSQL -E and then from a remote computer via
SQL -SYourServername -E
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
"Chris" <csmith@.mail.eascorp.org> schrieb im Newsbeitrag
news:042401c54a72$703536f0$a601280a@.phx.gbl...
> Hello,
> Article Q319930 states that MSDE clients must be members
> of the Administrators group on the machine which is
> hosting MSDE. Is this really correct? I want to use MSDE
> with non-admin clients, and have done the appropriate
> sp_grantdbaccess, but still get 'login failed' errors when
> using a non-admin account.
sql
Article Q319930 states that MSDE clients must be members
of the Administrators group on the machine which is
hosting MSDE. Is this really correct? I want to use MSDE
with non-admin clients, and have done the appropriate
sp_grantdbaccess, but still get 'login failed' errors when
using a non-admin account.
No, you can use Windows Auth. from the network not only locally. Did you set
the Auth. mode to mixed mode ? Sound like you ddidnt. Try to connect on the
computer MSDE is running to verify if its turned on via.: (must be in the
local administrators group when logged on)
Commandprompt: OSQL -E and then from a remote computer via
SQL -SYourServername -E
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
"Chris" <csmith@.mail.eascorp.org> schrieb im Newsbeitrag
news:042401c54a72$703536f0$a601280a@.phx.gbl...
> Hello,
> Article Q319930 states that MSDE clients must be members
> of the Administrators group on the machine which is
> hosting MSDE. Is this really correct? I want to use MSDE
> with non-admin clients, and have done the appropriate
> sp_grantdbaccess, but still get 'login failed' errors when
> using a non-admin account.
sql
Monday, March 19, 2012
MSDE login problem - Windows
I'm confused.
OS = Win XP Pro
I installed MSDE2000A on a new laptop using mixed security - Windows and
SQL. Everything went fine. At the time my everyday Windows user account wa
s
set up as a Windows (not SQL) administrator, so that I could get some other
software installed, too.
I subsequently changed my Windows user account to be a power user and NOT a
Windows administrator and now I cannot connect to MSDE with that Windows
account. If I switch the account back to Windows adminstrator all is well
with MSDE.
How can I coax MSDE to recognize this user account when it is no longer a
Windows administrator?Add your windows account to the Logins for MSDE. You are
getting in due to the default behavior of SQL Server adding
BUILTIN\Administrators as a login. That would include all
logins that are members of the local admins group.
You can add your login using sp_grantlogin. You can find
more information in books online.
-Sue
On Mon, 9 Jan 2006 08:07:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
>I'm confused.
>OS = Win XP Pro
>I installed MSDE2000A on a new laptop using mixed security - Windows and
>SQL. Everything went fine. At the time my everyday Windows user account w
as
>set up as a Windows (not SQL) administrator, so that I could get some other
>software installed, too.
>I subsequently changed my Windows user account to be a power user and NOT a
>Windows administrator and now I cannot connect to MSDE with that Windows
>account. If I switch the account back to Windows adminstrator all is well
>with MSDE.
>How can I coax MSDE to recognize this user account when it is no longer a
>Windows administrator?
>|||Sue -
Thanks for the guidance, but it looks like sp_grantlogin requires me to use
a domain name. The laptop is not part of a domain. Is there a workaround
for that?
"Sue Hoegemeier" wrote:
> Add your windows account to the Logins for MSDE. You are
> getting in due to the default behavior of SQL Server adding
> BUILTIN\Administrators as a login. That would include all
> logins that are members of the local admins group.
> You can add your login using sp_grantlogin. You can find
> more information in books online.
> -Sue
> On Mon, 9 Jan 2006 08:07:04 -0800, "Duke Carey"
> <DukeCarey@.discussions.microsoft.com> wrote:
>
>|||If you are logging into the laptop using a local account,
you would use:
MachineName\LoginName
-Sue
On Mon, 9 Jan 2006 16:29:02 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>Thanks for the guidance, but it looks like sp_grantlogin requires me to use
>a domain name. The laptop is not part of a domain. Is there a workaround
>for that?
>"Sue Hoegemeier" wrote:
>|||Sue -
I logged in to the laptop as Administrator and was automatically logged in
to MSDE. Within MSDE I then ran EXEC sp_grantlogin 'pc_name\duke' and it ra
n
successfully.
However, after logging in as Duke *without Windows administrator rights* I
was still unable to login to MSDE.
I have to be so dense, but what am I missing?
Duke
"Sue Hoegemeier" wrote:
> If you are logging into the laptop using a local account,
> you would use:
> MachineName\LoginName
> -Sue
> On Mon, 9 Jan 2006 16:29:02 -0800, "Duke Carey"
> <DukeCarey@.discussions.microsoft.com> wrote:
>
>|||If the login is there, you should be able to at least
connect.
So when you log in as Duke and try to log in to MSDE, what
is the exact error message - all the details?
-Sue
On Thu, 19 Jan 2006 08:24:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>I logged in to the laptop as Administrator and was automatically logged in
>to MSDE. Within MSDE I then ran EXEC sp_grantlogin 'pc_name\duke' and it r
an
>successfully.
>However, after logging in as Duke *without Windows administrator rights* I
>was still unable to login to MSDE.
>I have to be so dense, but what am I missing?
>Duke
>"Sue Hoegemeier" wrote:
>|||Sue -
There are no error messages as such
What is happening is that the SQL Service Mgr in the systray shows an empty
circle. When I open it I have to type in the pc name and select SQL Server
as the service. It then shows that it is already running. When I go into
MSDE Manager (Vale Software's management tool), it shows me logged in as
guest. It also shows the database owner (there's only one user database so
far) as hp_notebook\duke and says that I do not have permisssion to access
that database
If I grant my Windows login Windows Administrator status, MSDE starts fine
and I log in to the MSDE as myself
I don't know enough to provide you more helpful information
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:1q00t11aka3drrkih9ev7rofpbidk5c6dr@.
4ax.com...
> If the login is there, you should be able to at least
> connect.
> So when you log in as Duke and try to log in to MSDE, what
> is the exact error message - all the details?
> -Sue
>|||Okay...so you get on the server but can't do anything in
that database or can't access the database.
Add your Duke login as a user in the database using
sp_grantdbaccess.
If you need that login to be able to do anything and
everything on the MSDE instance, you can add that login to
the sysadmins server role using:
EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin'
-Sue
On Thu, 19 Jan 2006 19:02:51 -0500, "Duke Carey"
<dukecarey@.hotmail.com> wrote:
> When I go into
>MSDE Manager (Vale Software's management tool), it shows me logged in as
>guest. It also shows the database owner (there's only one user database so
>far) as hp_notebook\duke and says that I do not have permisssion to access
>that database|||Sue -
Thanks for sticking with me. It appears that things are working correctly
now.
EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin' seems to have done the
trick.
"Sue Hoegemeier" wrote:
> Okay...so you get on the server but can't do anything in
> that database or can't access the database.
> Add your Duke login as a user in the database using
> sp_grantdbaccess.
> If you need that login to be able to do anything and
> everything on the MSDE instance, you can add that login to
> the sysadmins server role using:
> EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin'
> -Sue
> On Thu, 19 Jan 2006 19:02:51 -0500, "Duke Carey"
> <dukecarey@.hotmail.com> wrote:
>
>|||Good to hear it's all working now - thanks for posting back!
-Sue
On Mon, 23 Jan 2006 06:31:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>Thanks for sticking with me. It appears that things are working correctly
>now.
>EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin' seems to have done the
>trick.
>
>"Sue Hoegemeier" wrote:
>
OS = Win XP Pro
I installed MSDE2000A on a new laptop using mixed security - Windows and
SQL. Everything went fine. At the time my everyday Windows user account wa
s
set up as a Windows (not SQL) administrator, so that I could get some other
software installed, too.
I subsequently changed my Windows user account to be a power user and NOT a
Windows administrator and now I cannot connect to MSDE with that Windows
account. If I switch the account back to Windows adminstrator all is well
with MSDE.
How can I coax MSDE to recognize this user account when it is no longer a
Windows administrator?Add your windows account to the Logins for MSDE. You are
getting in due to the default behavior of SQL Server adding
BUILTIN\Administrators as a login. That would include all
logins that are members of the local admins group.
You can add your login using sp_grantlogin. You can find
more information in books online.
-Sue
On Mon, 9 Jan 2006 08:07:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
>I'm confused.
>OS = Win XP Pro
>I installed MSDE2000A on a new laptop using mixed security - Windows and
>SQL. Everything went fine. At the time my everyday Windows user account w
as
>set up as a Windows (not SQL) administrator, so that I could get some other
>software installed, too.
>I subsequently changed my Windows user account to be a power user and NOT a
>Windows administrator and now I cannot connect to MSDE with that Windows
>account. If I switch the account back to Windows adminstrator all is well
>with MSDE.
>How can I coax MSDE to recognize this user account when it is no longer a
>Windows administrator?
>|||Sue -
Thanks for the guidance, but it looks like sp_grantlogin requires me to use
a domain name. The laptop is not part of a domain. Is there a workaround
for that?
"Sue Hoegemeier" wrote:
> Add your windows account to the Logins for MSDE. You are
> getting in due to the default behavior of SQL Server adding
> BUILTIN\Administrators as a login. That would include all
> logins that are members of the local admins group.
> You can add your login using sp_grantlogin. You can find
> more information in books online.
> -Sue
> On Mon, 9 Jan 2006 08:07:04 -0800, "Duke Carey"
> <DukeCarey@.discussions.microsoft.com> wrote:
>
>|||If you are logging into the laptop using a local account,
you would use:
MachineName\LoginName
-Sue
On Mon, 9 Jan 2006 16:29:02 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>Thanks for the guidance, but it looks like sp_grantlogin requires me to use
>a domain name. The laptop is not part of a domain. Is there a workaround
>for that?
>"Sue Hoegemeier" wrote:
>|||Sue -
I logged in to the laptop as Administrator and was automatically logged in
to MSDE. Within MSDE I then ran EXEC sp_grantlogin 'pc_name\duke' and it ra
n
successfully.
However, after logging in as Duke *without Windows administrator rights* I
was still unable to login to MSDE.
I have to be so dense, but what am I missing?
Duke
"Sue Hoegemeier" wrote:
> If you are logging into the laptop using a local account,
> you would use:
> MachineName\LoginName
> -Sue
> On Mon, 9 Jan 2006 16:29:02 -0800, "Duke Carey"
> <DukeCarey@.discussions.microsoft.com> wrote:
>
>|||If the login is there, you should be able to at least
connect.
So when you log in as Duke and try to log in to MSDE, what
is the exact error message - all the details?
-Sue
On Thu, 19 Jan 2006 08:24:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>I logged in to the laptop as Administrator and was automatically logged in
>to MSDE. Within MSDE I then ran EXEC sp_grantlogin 'pc_name\duke' and it r
an
>successfully.
>However, after logging in as Duke *without Windows administrator rights* I
>was still unable to login to MSDE.
>I have to be so dense, but what am I missing?
>Duke
>"Sue Hoegemeier" wrote:
>|||Sue -
There are no error messages as such
What is happening is that the SQL Service Mgr in the systray shows an empty
circle. When I open it I have to type in the pc name and select SQL Server
as the service. It then shows that it is already running. When I go into
MSDE Manager (Vale Software's management tool), it shows me logged in as
guest. It also shows the database owner (there's only one user database so
far) as hp_notebook\duke and says that I do not have permisssion to access
that database
If I grant my Windows login Windows Administrator status, MSDE starts fine
and I log in to the MSDE as myself
I don't know enough to provide you more helpful information
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:1q00t11aka3drrkih9ev7rofpbidk5c6dr@.
4ax.com...
> If the login is there, you should be able to at least
> connect.
> So when you log in as Duke and try to log in to MSDE, what
> is the exact error message - all the details?
> -Sue
>|||Okay...so you get on the server but can't do anything in
that database or can't access the database.
Add your Duke login as a user in the database using
sp_grantdbaccess.
If you need that login to be able to do anything and
everything on the MSDE instance, you can add that login to
the sysadmins server role using:
EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin'
-Sue
On Thu, 19 Jan 2006 19:02:51 -0500, "Duke Carey"
<dukecarey@.hotmail.com> wrote:
> When I go into
>MSDE Manager (Vale Software's management tool), it shows me logged in as
>guest. It also shows the database owner (there's only one user database so
>far) as hp_notebook\duke and says that I do not have permisssion to access
>that database|||Sue -
Thanks for sticking with me. It appears that things are working correctly
now.
EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin' seems to have done the
trick.
"Sue Hoegemeier" wrote:
> Okay...so you get on the server but can't do anything in
> that database or can't access the database.
> Add your Duke login as a user in the database using
> sp_grantdbaccess.
> If you need that login to be able to do anything and
> everything on the MSDE instance, you can add that login to
> the sysadmins server role using:
> EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin'
> -Sue
> On Thu, 19 Jan 2006 19:02:51 -0500, "Duke Carey"
> <dukecarey@.hotmail.com> wrote:
>
>|||Good to hear it's all working now - thanks for posting back!
-Sue
On Mon, 23 Jan 2006 06:31:04 -0800, "Duke Carey"
<DukeCarey@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Sue -
>Thanks for sticking with me. It appears that things are working correctly
>now.
>EXEC sp_addsrvrolemember 'pc_name\duke', 'sysadmin' seems to have done the
>trick.
>
>"Sue Hoegemeier" wrote:
>
Monday, March 12, 2012
MSDE Lockdown scripts
We are installing MSDE along with one of our applications.
But with the current security threats, we want to make sure
that the installed MSDE is secure. So is there any lock
down scripts available publicly that can be used for the same.
Thanks in Advance.
hi,
"Arunkumar Viswanathan" <anonymous@.discussions.microsoft.com> ha scritto nel
messaggio news:012101c4904c$0eea0af0$a401280a@.phx.gbl...
> We are installing MSDE along with one of our applications.
> But with the current security threats, we want to make sure
> that the installed MSDE is secure. So is there any lock
> down scripts available publicly that can be used for the same.
not that I'm aware of... anyway, MSDE installs by default disabling network
protocols and with Windows NT authentication only... you only have to set a
strong "sa" password...
this is the *standard*, and should be quite secure... but usually you will
need remote connections (which require TCP/IP or other preferred network
protocol to be enabled) ... if you do not need SQL Server authenticated
connections, you can go with the default "trusted" only...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Hi Andrea,
Thanks for replying. As you rightly said the we have to
provide a strong password to the sa user. But generally in
a stand alone MSDE installation some stored procedures are
given public previleges and that can cause problems with
advanced users. So if you of know of any lock down scripts
pls post the link here.
Thanks
Arunkumar
>--Original Message--
>not that I'm aware of... anyway, MSDE installs by default
disabling network
>protocols and with Windows NT authentication only... you
only have to set a
>strong "sa" password...
>this is the *standard*, and should be quite secure... but
usually you will
>need remote connections (which require TCP/IP or other
preferred network
>protocol to be enabled) ... if you do not need SQL Server
authenticated
>connections, you can go with the default "trusted" only...
>--
>Andrea Montanari (Microsoft MVP - SQL Server)
>http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
>DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
>(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE
2000 a visual
>interface)
>-- remove DMO to reply
>.
>
|||hi Arunkumar,
<anonymous@.discussions.microsoft.com> ha scritto nel messaggio
news:452d01c49052$8853d550$a601280a@.phx.gbl...
> Hi Andrea,
> Thanks for replying. As you rightly said the we have to
> provide a strong password to the sa user. But generally in
> a stand alone MSDE installation some stored procedures are
> given public previleges and that can cause problems with
> advanced users. So if you of know of any lock down scripts
> pls post the link here.
again... unfortunately I do not know one :-(
but, again, it all depends on what you want to secure...
if you mean system stored procedures, usually (at least the problematic,
like xp_cmdshell and so on) they are "protected" requiring sysadmins
privileges
on the other side, if you mena your own procedures, it' up to you to remove
"guest" permission to them =;-D
so I usually remove guest login and deny public involvement... and I do
manage privileges in user's groups...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
But with the current security threats, we want to make sure
that the installed MSDE is secure. So is there any lock
down scripts available publicly that can be used for the same.
Thanks in Advance.
hi,
"Arunkumar Viswanathan" <anonymous@.discussions.microsoft.com> ha scritto nel
messaggio news:012101c4904c$0eea0af0$a401280a@.phx.gbl...
> We are installing MSDE along with one of our applications.
> But with the current security threats, we want to make sure
> that the installed MSDE is secure. So is there any lock
> down scripts available publicly that can be used for the same.
not that I'm aware of... anyway, MSDE installs by default disabling network
protocols and with Windows NT authentication only... you only have to set a
strong "sa" password...
this is the *standard*, and should be quite secure... but usually you will
need remote connections (which require TCP/IP or other preferred network
protocol to be enabled) ... if you do not need SQL Server authenticated
connections, you can go with the default "trusted" only...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
|||Hi Andrea,
Thanks for replying. As you rightly said the we have to
provide a strong password to the sa user. But generally in
a stand alone MSDE installation some stored procedures are
given public previleges and that can cause problems with
advanced users. So if you of know of any lock down scripts
pls post the link here.
Thanks
Arunkumar
>--Original Message--
>not that I'm aware of... anyway, MSDE installs by default
disabling network
>protocols and with Windows NT authentication only... you
only have to set a
>strong "sa" password...
>this is the *standard*, and should be quite secure... but
usually you will
>need remote connections (which require TCP/IP or other
preferred network
>protocol to be enabled) ... if you do not need SQL Server
authenticated
>connections, you can go with the default "trusted" only...
>--
>Andrea Montanari (Microsoft MVP - SQL Server)
>http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
>DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
>(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE
2000 a visual
>interface)
>-- remove DMO to reply
>.
>
|||hi Arunkumar,
<anonymous@.discussions.microsoft.com> ha scritto nel messaggio
news:452d01c49052$8853d550$a601280a@.phx.gbl...
> Hi Andrea,
> Thanks for replying. As you rightly said the we have to
> provide a strong password to the sa user. But generally in
> a stand alone MSDE installation some stored procedures are
> given public previleges and that can cause problems with
> advanced users. So if you of know of any lock down scripts
> pls post the link here.
again... unfortunately I do not know one :-(
but, again, it all depends on what you want to secure...
if you mean system stored procedures, usually (at least the problematic,
like xp_cmdshell and so on) they are "protected" requiring sysadmins
privileges
on the other side, if you mena your own procedures, it' up to you to remove
"guest" permission to them =;-D
so I usually remove guest login and deny public involvement... and I do
manage privileges in user's groups...
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.9.1 - DbaMgr ver 0.55.1
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
Saturday, February 25, 2012
MSDE Install
When I tried to install MSDE I got message :
"A strong SA password is required for security reasons. Please use SAPWD switch to supply the same."
"A strong SA password is required for security reasons. Please use SAPWD switch to supply the same."
What should I do ? I'm using XP pro and VS 2003You have to specify a password
Type Setup SAPWD=(Some password) SecurityMode=SQL
See here
http://www.asp.net/msde/Default.aspx?tabindex=0&tabid=1
Instruction 2|||I'be tryed it and it didn't work. Can we Install MSDE on XP Pro ?
Jeff|||Yes you can install MSDE on XP Pro. You can also use Access 2002 to connect to SQL Server or MSDE by creating a project file.
Cheers|||Sounds interesting...how can you connect to MSDE with Access ?
Thanks,
Jeff
Subscribe to:
Posts (Atom)