Connecting to DB with the 'machine' account

josef

This seems like a bad idea, but I'm having trouble identifying why.
With an ASP.NET application I am using Windows Integrated
Authentication. The aspnet_wp.exe runs as 'machine' per the
processModel element in machine.config. By creating a domain\machine$
user in the database, I can successfully connect to the database.

So in my case the domain is flintstone and the web server is fred. By
adding the flintstone\fred $ user to the database, any .NET process
running on the web server can connect to the database. It seems like
I'm opening the database up for malicous attacks from a rogue process
on the web server.

By moving from integrated security in the connection string to an
explicit user/pwd I appear to have more control over what processes can
access the database.

What are your thoughts about this?

Nov 19 '05 #1

Subscribe Reply

1740

Eliyahu Goldin

True.

Eliyahu

<jo***@wainz.ne t> wrote in message
news:11******** **************@ o13g2000cwo.goo glegroups.com.. .

This seems like a bad idea, but I'm having trouble identifying why.
With an ASP.NET application I am using Windows Integrated
Authentication. The aspnet_wp.exe runs as 'machine' per the
processModel element in machine.config. By creating a domain\machine$
user in the database, I can successfully connect to the database.

So in my case the domain is flintstone and the web server is fred. By
adding the flintstone\fred $ user to the database, any .NET process
running on the web server can connect to the database. It seems like
I'm opening the database up for malicous attacks from a rogue process
on the web server.

By moving from integrated security in the connection string to an
explicit user/pwd I appear to have more control over what processes can
access the database.

What are your thoughts about this?

Nov 19 '05 #2

Terminator.Net

By specifying explicity user/pwd you are enabling someone to discover a
username and password which can be used from any other server to connect to
the SQL Server. Moreover making the passwords of a user known to anyone who
opens up a file ( I am assuming this is in the web.config) is not a very good
idea, intuitively.

On the machine account side, you are sure of one thing that the machine is a
member of the active directory, which itself is a certain level of security.
Also generally machine accounts are given access to a database when both the
web server as well as the DB server are in the your (or support team's)
control and nobody else has physical access to those boxes.

My 2 cents!!

"jo***@wainz.ne t" wrote:

This seems like a bad idea, but I'm having trouble identifying why.
With an ASP.NET application I am using Windows Integrated
Authentication. The aspnet_wp.exe runs as 'machine' per the
processModel element in machine.config. By creating a domain\machine$
user in the database, I can successfully connect to the database.

So in my case the domain is flintstone and the web server is fred. By
adding the flintstone\fred $ user to the database, any .NET process
running on the web server can connect to the database. It seems like
I'm opening the database up for malicous attacks from a rogue process
on the web server.

By moving from integrated security in the connection string to an
explicit user/pwd I appear to have more control over what processes can
access the database.

What are your thoughts about this?

Nov 19 '05 #3

Similar topics

2010

Connecting to SQL Server using Windows Authentication

by: Jeremy | last post by:

In my ASP.NET web applications I would like to use "integrated security=SSPI" instead of supplying a SQL Server account credentials. From what I understand there are security policy settings that need to be setup on the web server to allow for me to do this, but I'm not 100% sure what they are. I think I have to allow a remote token (from remote computers) and Kerberos, and in IIS use Integrated Windows Authentication (with basic and...

.NET Framework

2413

Connecting to SQLServer 2000 from ASP.NET

by: Patrick | last post by:

I have an ASP.NET application that connects to a SQL Server database. The SQL Server resides on a seperate development server from the IIS5.1 on Windows XP SP2 on development PCs which host the ASP.NET application. I would like to use Integrated Windows Authentication like Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=DBName;Data Source=DevServer1 My problems!

ASP.NET

1260

Connecting Database in thread

by: Makarand Keer | last post by:

Hi all Gurus I have asp.net application where I am creating background process using Threading. My threading involves invoking method which in turn gets some data from SQL server using Windows Authentication. But when I run my app, connection error comes as "{"Login failed for user '(null)'. Reason: Not associated with a trusted SQL Server connection." }". When I check the System.Threading.Thread.CurrentPrincipal properties it

ASP.NET

3354

Logon Failed connecting to SQL Server

by: David Tilman | last post by:

I've gone throught the MSDN walkthrough "Creating a Web Application Using Visual C# or Visual Basic". When I run the sample I get "Login failed for user 'dbuser'" at the line with "SqlDataAdapter1.Fill(dSet)". The SQL server is setup for mixed mode and I have a login in Enterprise Manager for the dbuser account. I've setup a system DSN in ODBC on the client which tested succesfully. In Visual Studio 2003 I've chosen "Preview Data..." for...

ASP.NET

2776

Separate Webserver and SQL Server -- error when connecting asp.netapp to a database

by: Ann Marinas | last post by:

Hi all, I would like to ask for some help regarding separating the asp.net webserver and the sql server. I have created an asp.net application for a certain company. Initially, we installed both the iis and sql server in a single machine. Not too long ago, the machine had some hardware problems, and management has decided to purchase new servers, for both asp.net and sql server.

ASP.NET

2697

Connecting to a network share

by: Matt Dockerty | last post by:

Hi, I'm trying to connect to a network share using a username / password / domain of my choosing. I've tried the WindowsIdentity.Impersonate route but can only impersonate the users on the local machine / domain using this method. I could go about creating actual mapped drives but I'd much rather connect temporarily to a UNC share without affecting the system configuration.

ASP.NET

3734

Error connecting to SQL Server through a Web Service???

by: GTDriver | last post by:

I'm trying to connect my application with a web service located on my own web server(localhost). I guess when the solution/proect is built it makes a file called 'Web References\localhost\References.vb' In this file a line of code reports the following error: Line of code: Dim results() As Object = Me.Invoke("GetCustomers", New Object() {Country})

.NET Framework

4119

Problem connecting to my database

by: Patrick F | last post by:

Hi, i have SQL Server 2005 and a database set that is called, myCompany the problem is that i cant connect from my page to it, here is from the web.config: ( i have got this connectionstring from my sqldataobject on my page) <add name="ConStr" connectionString="Data Source=localhost;Initial Catalog=myCompany;Integrated Security=True" providerName="System.Data.SqlClient" /> the strange part is that its trying to connect to a SQL express...

ASP.NET

1935

How do I connect to my database when I'm using IIS (connecting via http://localhost/...)

by: mark4asp | last post by:

How do I connect to my application via http://localhost/..., using IIS. I've developed an application via the File System (using the VS Web server). When I deploy it I change the <appSettingsFrom MyAppConnString_localhost to MyAppConnString_live (see config settings below). Up to now connections have worked fine.

ASP.NET

8486

What is ONU?

by: marktang | last post by:

ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...

General

8404

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...

Windows Server

8828

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...

Online Marketing

8680

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...

General

5705

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...

C# / C Sharp

4227

Trying to create a lan-to-lan vpn between two differents networks

by: TSSRALBI | last post by:

Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...

Networking - Hardware / Configuration

4418

Windows Forms - .Net 8.0

by: adsilva | last post by:

A Windows Forms form does not have the event Unload, like VB6. What one acts like?

Visual Basic .NET

2819

transfer the data from one system to another through ip address

by: 6302768590 | last post by:

Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system

C# / C Sharp

2063

How to add payments to a PHP MySQL app.

by: muto222 | last post by:

How can i add a mobile payment intergratation into php mysql website.

PHP