I'm trying to give access to users outside my firewall using an untrusted
sql login but for some reason I'm not able to do this.
I've opened up port 1433 on the firewall and pointed it to the server with
the same port number but I'm still not able to make a connection.
Is there anything I need to do to let external users access the database on
sql server 2005.
TIA,
JacksonOn Jan 30, 12:00=A0pm, "Jackson Lee" <j...@.intermixny.com> wrote:
> I've opened up port 1433 on the firewall and pointed it to the server with=
> the same port number but I'm still not able to make a connection.
Do you have local and remote connections for TCP/IP enabled on the SQL
Server? Verify that it is listening on 1433. If you are able to
connect from remote machines on your local network, then your problem
is probably on your firewall layer.
Curtis
Showing posts with label outside. Show all posts
Showing posts with label outside. Show all posts
Sunday, February 19, 2012
Giving access to outside web site to SQL Server stored procedure
Hello, I have a sql server 2000 production database that will need to have
multiple web sites insert contact information into a table. I plan to
create a new sql user and only give it permission to execute one stored
procedure (that will do the insert row into the contact table).
Then I will provide to any outside vendor the SQL Server name, database,
user id, password and stored procedure(and input parameters) name. What are
the security concerns with this?
Would it make any sense to create a database with only this table in it, or
is this just overkill. I see that when I assign a new user to just one
database and one stored procedure that they can see the master database. Is
this an issue? Should I give the user
db_denydatareader on the master database?
Thanks
DonDon (dons100@.ameritech.net) writes:
> Hello, I have a sql server 2000 production database that will need to have
> multiple web sites insert contact information into a table. I plan to
> create a new sql user and only give it permission to execute one stored
> procedure (that will do the insert row into the contact table).
> Then I will provide to any outside vendor the SQL Server name, database,
> user id, password and stored procedure(and input parameters) name. What
> are the security concerns with this?
> Would it make any sense to create a database with only this table in it,
> or is this just overkill. I see that when I assign a new user to just
> one database and one stored procedure that they can see the master
> database. Is this an issue? Should I give the user db_denydatareader
> on the master database?
I would rather not expose an SQL Server on the Internet at all, least of
all SQL 2000. SQL 2000 no protection against brute-force attacks whatsoever.
Even if you have a really strong password for sa, someone might be able to
crack it. The server would also be open for denial-of-service attacks.
I think you should better implement some sort of web service. Not
necessarily with XML. But something that listens on a TCP/IP port, possibly
authenticates the user, and then connects to SQL Server with this low-
priv user you described. Username and password would be hard-coded into
this service, or read from a file.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx
multiple web sites insert contact information into a table. I plan to
create a new sql user and only give it permission to execute one stored
procedure (that will do the insert row into the contact table).
Then I will provide to any outside vendor the SQL Server name, database,
user id, password and stored procedure(and input parameters) name. What are
the security concerns with this?
Would it make any sense to create a database with only this table in it, or
is this just overkill. I see that when I assign a new user to just one
database and one stored procedure that they can see the master database. Is
this an issue? Should I give the user
db_denydatareader on the master database?
Thanks
DonDon (dons100@.ameritech.net) writes:
> Hello, I have a sql server 2000 production database that will need to have
> multiple web sites insert contact information into a table. I plan to
> create a new sql user and only give it permission to execute one stored
> procedure (that will do the insert row into the contact table).
> Then I will provide to any outside vendor the SQL Server name, database,
> user id, password and stored procedure(and input parameters) name. What
> are the security concerns with this?
> Would it make any sense to create a database with only this table in it,
> or is this just overkill. I see that when I assign a new user to just
> one database and one stored procedure that they can see the master
> database. Is this an issue? Should I give the user db_denydatareader
> on the master database?
I would rather not expose an SQL Server on the Internet at all, least of
all SQL 2000. SQL 2000 no protection against brute-force attacks whatsoever.
Even if you have a really strong password for sa, someone might be able to
crack it. The server would also be open for denial-of-service attacks.
I think you should better implement some sort of web service. Not
necessarily with XML. But something that listens on a TCP/IP port, possibly
authenticates the user, and then connects to SQL Server with this low-
priv user you described. Username and password would be hard-coded into
this service, or read from a file.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx
Subscribe to:
Posts (Atom)