SQL Express MDF Security

Jul 10, 2007

Hi All,

I have a application having SQL Express as database. As the application will be installed on the client system, probably a server as per the user requirements, I require that the database cannot be accessed by anyone. As we know that the mdf and ldf files can be taken away by anyone and they can get the database structure as well as the data from database.

e.g. I install this application on one server, now any technical person can easily take a backup and install it on another server or can get the script of the database even if the db owner user id and password are blocked by me.

Please suggest me how can I block such action so that the database design and data cannot be accessed by any one outside the development team. I don't want the database schema to be revelead to anyone as it can harm the products information security.

View 2 Replies

SQL Server Express Security?

Oct 21, 2005

We are releasing an application built on SQL Server Express in the next few months. Our clients are mostly small companies with little technical knowledge, and they will be using our application on desktop computers where everyone likely logs in as the same user. As such, my thinking is that we setup SQL Server Express as in SQL Server Authentication mode. This way they could select an Administrator password upon first installation, and manage user names and passwords from within the application itself.

View 22 Replies View Related

Express Database Security

Sep 14, 2007

Could somebody explain to me how does database security in the SQL Server Express environment works? It would seem that there has to be some level of "interplay" between the user's basic level of authority in Windows security on the machine (e.g., "Adminstrator" vs. "User"), the implications that that has on their level of access to the hard drive location where the database file is stored, and how security is configured within the database engine.

View 3 Replies View Related

SQL Server Express Security Nightmare

Apr 16, 2007

I've built this prototype web app in asp.net 2.0

it uses a sql server express database.

It uses the database to populate a grid control.

It works when I run it from my pc when I

1). run it in debug mode.

2) right click a page in the vs2005 IDE and browse

3). browse a page from the IIS snap in

it doesn't work from other peoples PC on our intranet say if someone types:

http://xxx.xxx.xx.xx/mywebapp/default.aspx because I get this result:

Server Error in '/FocusII_Website' Application.
--------------------------------------------------------------------------------

User does not have permission to perform this action.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: User does not have permission to perform this action.

Source Error:

Line 82:
Line 83: SqlDataAdapter da = new SqlDataAdapter(sql, ConfigurationManager.ConnectionStrings["sqlExpress"].ToString());
Line 84: da.Fill(ds);
Line 85: RadGrid1.DataSource = ds;
Line 86: RadGrid1.DataBind();

Source File: c:InetpubwwwrootFocusII_WebsiteUnitGridPrototype.aspx.cs Line: 84

Stack Trace:

[SqlException (0x80131904): User does not have permission to perform this action.]
System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +437
System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +82
System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +105
System.Data.SqlClient.SqlConnection.Open() +111
System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +121
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +137
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +86
UnitGridPrototype.Page_Load(Object sender, EventArgs e) in c:InetpubwwwrootFocusII_WebsiteUnitGridPrototype.aspx.cs:84
System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +15
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +34
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +47
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1061

--------------------------------------------------------------------------------

Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42

Impersonation is set to TRUE

Anonymous access is checked.

Integrated Windows Authentication is checked..

aspnet, iusr accounts have full privs on the data directory,,,,,

I'm at a loss..