Re: Encryption of application configuration block

Hi Steven,

Another, more secure option is to use Windows authentication and
configure
access to Sql Server objects based on the current users' Windows account.
This would potentially help (although I still don't like potential hackers
being told exactly what database we are using on which server - I'd prefer
as
little info as possible to be shown!).
...
We only have a single SQL login per application
and manage the user roles etc. within the application itself. This means
that
connection pooling kicks in for the whole domain.

Hackers that have access to your .config files would find out where your
database is regardless. Using a single SQL login makes it less secure.

"Steven Cliff" <stevecliff@xxxxxxxxxxxxxxxxx> wrote in message
news:B0F31DBB-B3DB-4BB7-864E-FDDB45506AF4@xxxxxxxxxxxxxxxx
Thanks for the reply Dave.

If your trying to protect an Sql login password then instead create an
Sql
login with only those permissions that are required by your application.
This causes us a problem in that we do not want users triggering parts of
the application out of order. E.G. A user has to have rights to delete X,
but
the application stops the user deleting X when Y exists. Without the
business
logic in the application the user could potentially play havoc with the
system.

Another, more secure option is to use Windows authentication and
configure
access to Sql Server objects based on the current users' Windows account.
This would potentially help (although I still don't like potential hackers
being told exactly what database we are using on which server - I'd prefer
as
little info as possible to be shown!). Unfortunately as soon as you follow
this route, the connection pooling feature of SQL becomes dramatically
less
used and performance drops. We only have a single SQL login per
application
and manage the user roles etc. within the application itself. This means
that
connection pooling kicks in for the whole domain.

note that configuration encryption is intended for applications that
reside on a server and not applications that are frequently deployed to
client machines:
Hmm ... yep, that is the problem i am having :-(

What I can't believe is that if I wish to deploy Winforms applications out
to numerous desktops securely, then the DAAB of the Enterprise Library
cannot
be used? This sounds like I'm missing something - but the more I look in
to
it the more I'm beginning to believe that it's impossible! :-(

I'm stuck with reverting back to the old "SQLHelper" extensions or rolling
my own but after having spent a couple of weeks converting everything
across
to the new DAAB & DataFactory set up I'm reluctant to throw it all in the
bin.

If it *is* impossible to do this way, does anyone know of a way that I can
dynamically change the connection string in one of the new DataFactory
CreateDatabase statements? I.E. I could point the datafactory to a dummy
alias and then override the connection string with manually decyphered
information that I could hold elsewhere? That would mean I can still use
the
new datafactory routines, keep a secure app.config and deploy out to many
clients without problems.




.

Relevant Pages

  • Re: 2005 SSIS issue
    ... fine.If I set the SQL 2000 connection to SQL Authentication and the SQL ... [Transfer SQL Server Objects Task] ... So I uninstalled sql server (not SSIS, ...
    (microsoft.public.sqlserver.dts)
  • Re: sql 2000 DTS task in sql 2005
    ... It is no longer in the Import/Export wizard but it is in the Proper BIDs designer. ... (Transfer SQL Server Objects Task) ... from one database to another without problem. ...
    (microsoft.public.sqlserver.dts)
  • Re: connection options to yukon
    ... Connection pooling depends on the fact that repeated SqlConnection objects ... My recommendation would be to use Windows authentication over sql Auth ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: How to SELECT records based upon ASP.NET Roles
    ... connection pooling will work better than if a large ... as a SQL Login.) ... Row level permissions is kind a complicated topic to be implemented ... Since you can't pass parameters to views, you'll restrict the ...
    (microsoft.public.dotnet.security)
  • Re: VB with SQL Server... Unable to create temp table using ADO connection object
    ... > I am not using connection pooling. ... SQL Server MVP ... but when I query the temp table either in VB or in SQL ...
    (microsoft.public.sqlserver.programming)
Loading