Re: database split before or after security?

On Sat, 25 Mar 2006 09:08:31 -0500, "Joan Wild"
<jwild@xxxxxxxxxxxxxxxx> wrote:

Charlie via AccessMonster.com wrote:
Hi Access Heros,
I created a new database in Access 2003. I created a new workgroup
file as owner. As owner, I created a new database and imported
tables from original db for my backend. Then I created another
database, as workgroup owner and imported queries, forms and reports,
as frontend. Does it make sense to do it this way? Doesn't this set
security on both the backend and frontend?

That alone does not. When you import objects, their permissions don't come
with them, so you have to set them again.


Joan

I didn't know that -- actually I thought you were wrong, but
experimentation proved to me that you were right.

For example, I logged onto a secure workgroup as a user who has
ReadData/Write on many tables, ReadData on a few tables, and
ModifyDesign permission on no tables. Imported some tables into a
brand-new database created by that user. I was able to
read/write/design all the tables, just as you suggested.

This means that a knowledgeable, motivated, and perhaps malicious user
could simple create a new database from one for which s/he had
ReadDesign permission, copy all the objects into a new database, and
replace the official database with this new, compromised database. The
user would be able to modify data in any table for which s/he had
previously been denied Write permission.

No need for a password cracking program!

If the user does not have ReadDesign permission on the table, the s/he
is denied permission to import the table into the new database. RWOP
queries take on a new significance.
**********************jackmacMACdonald@xxxxxxxxxxxxxx
remove uppercase letters for true email
http://www.geocities.com/jacksonmacd/ for info on MS Access security
.

Relevant Pages

  • Re: Cross database update issue
    ... Also, for dbo-owned objects, the owner of both databases must be the ... You can execute sp_helpdb to determine the current database owners. ... > User Name: Test1 Role Name=Test ... > Role Test has select permission to table t_test ...
    (microsoft.public.sqlserver.security)
  • Re: Dual Workgroup - Problem with creating administrators
    ... Every user must have permission to open the database. ... Administrators can have permission to open the database, ... If you use this workgroup, that user will now be able to enter any ...
    (microsoft.public.access.security)
  • Re: 2007 wont open older format database
    ... The database is a 2000 format ... (which is overridden by using that shortcut with the secure workgroup command ... permission if the db is secure. ... Find out what the actual error message is when she tries to open the db.. ...
    (comp.databases.ms-access)
  • Re: PHP Query Issues on Ingres R3 Linux Version
    ... If a table is owned by the DBA (the database owner) then there is no ... "permission" thing so much as an object ownership issue. ... An object which is not prefixed by a schema name is found by looking ...
    (comp.databases.ingres)
  • Re: code access security
    ... Error 1 CREATE ASSEMBLY for assembly 'GmsSqlClr' failed because assembly ... owner has EXTERNAL ACCESS ASSEMBLY permission and the database has the ... make sure the database owner is mapped to the correct login on ...
    (microsoft.public.dotnet.languages.csharp)