using logins

[Ezekiël]

Hello,

I'm currently developing an access application which uses sql server as a
backend.

What i'm uncertain about, is how i should setup security without creating
too many sql server logins. I'm convinced that i should limit access to sql
server, otherwise people can get in with other means than my application
(e.g. odbc, sem, etc.).
I've setup sql server in mixed mode and created a login for my application
to connect to a database.

So, what is the best way to implement tight security, but still be able to
log the current user and hostname? If a separate table is needed to created
users and passwords, please tell me how to use it, i've never done that
approach.

Thnx
--
----------------------------------------------------
This mailbox protected from junk email by MailFrontier Desktop
from MailFrontier, Inc. http://info.mailfrontier.com

[Erland Sommarskog]

Ezekiël (ezekië[e-mail]) writes:

I'm currently developing an access application which uses sql server as a
backend.

What i'm uncertain about, is how i should setup security without
creating too many sql server logins. I'm convinced that i should limit
access to sql server, otherwise people can get in with other means than
my application (e.g. odbc, sem, etc.). I've setup sql server in mixed
mode and created a login for my application to connect to a database.

So, what is the best way to implement tight security, but still be able
to log the current user and hostname? If a separate table is needed to
created users and passwords, please tell me how to use it, i've never
done that approach.

Use Windows Authentication. Don't use a single application user, this
means that if some manages to crack that code - and this is easy, he
may have access to too much.

Don't expose tables - only grant access to stored procedures.
--
Erland Sommarskog, SQL Server MVP, es****@sommarskog.se

Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techinf...2000/books.asp