Re: Windows service


"Chris Mullins [MVP - C#]" <cmullins@xxxxxxxxx> wrote in message news:OESylA$FIHA.1316@xxxxxxxxxxxxxxxxxxxxxxx
"Mr. Arnold" <MR. Arnold@xxxxxxxxxx> wrote

"Bela Istok" <bela_i@xxxxxxxxxxx> wrote in message news:F0EA16A6-A2DF-4B80-B823-592BCA8BED4B@xxxxxxxxxxxxxxxx
Arnold If you store the logins in the App.Config you can compromise the server if someone get to the machine, the best way is to use integrated in the service (if the service is running in the user stations).

You do know that you can encrypt a configuration file in .NET 2.0 don't you?

http://www.codeproject.com/useritems/Configuration_File.asp

While that's an option, it's a real pain. Worse, it's still less secure that using Windows Auth to the SQL DB. I've actually done this before (we were hitting an Oracle DB that didn't support Windows Auth), using both the COM+ method recommend by the PAG group, and using the DPAPI method others have recommended. It worked, but it's alot of overhead both for the devs and the sys admins to worry about.

If you can use it, Windows Auth to the SQL Database is better in every way.

It's only good for a solution that's running in a domain. It's not good for a solution that the users are not in a NT domain environment. I have not seen NT Authenticated user used for a means of connecting to a SQL Server database by any application, even in a domain. That seems to be a PITA for a DBA, and I think they avoid it, at least the ones I have worked with. Some DBA's have a special sequence of characters to kind of encrypt the psw a kind of their own blend or take on the psw.



.

Relevant Pages

  • Login failed after reseting password
    ... My domain user account had its password changed. ... Can I not login to SQL Server becuase the SID has changed? ... Servers using windows auth. ...
    (microsoft.public.sqlserver.security)
  • Re: Windows service
    ... used on the running machine is established on SQL 2005 server and SQL 2005 express. ... You might convince me on the little more secure, but not the less maintenance part of just having a generic user-id and psw that an app uses. ...
    (microsoft.public.dotnet.languages.csharp)
  • =?iso-8859-1?Q?Re:_Arbeiten_in_Arbeitsgruppe_statt_Dom=E4ne?=
    ... Eine Anwendung greift auf einen SQL 2000 Server via ODBC zu, ... anscheinend akzeptiert er so nur lokale Benutzer. ... die Möglichkeit vom Single SignOn bei der Windows Auth. ...
    (microsoft.public.de.sqlserver)
  • Linked server and Windows authentication
    ... Server A is running in Mixed mode(Both SQL and Windows auth). ... While setting up a linked server B on Server A, ...
    (microsoft.public.sqlserver.security)
  • Re: Windows service
    ... used on the running machine is established on SQL 2005 server and SQL 2005 ... The recommend practice is to use Windows Auth from the service to SQL ... There would be 2 connection strings in the AppConfig, ...
    (microsoft.public.dotnet.languages.csharp)