applications with Shared SQL users .. minimizing risk

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

jc - 18 Jul 2008 16:04 GMT

We installed this new Application.. The vendor insisted we use a
common (single) SQL users for the ODBC dsn system entry..

Is there any way to enforce that this user/password is only used with
that ODBC entry and not a a sql client.

Can we log in SQL server 2005 by IP.. Say a table is suddenly missing,
how will we know who did it? If through the application or from a sql
client?

Reply to this Message

Eric Russell - 18 Jul 2008 16:28 GMT

Perhaps the vendor suggests a single SQL Server login account in order to
implement connection pooling. This account should have minimal permissions;
do not add it to the datareader or datawriter roles, just grant it exec
permisisons on the procedure calls it needs. The PW for this SQL Server
account should be stored in web.config or a DSN on the server and not
supplied to the users. If the users are to login to the application, then use
windows authentication or a forms based login form.

> We installed this new Application.. The vendor insisted we use a
> common (single) SQL users for the ODBC dsn system entry..
[quoted text clipped - 5 lines]
> how will we know who did it? If through the application or from a sql
> client?

Reply to this Message