Re: Life out there ?

Well, here's my 2 cents.  

Security is clearly a significant issue when using SQL/Server data with IIS.
I have read about the "integrated security" from IIS that ties the ids and
passwords of NT and SQL/Server together but I'm not sure whether I want to
use it.  I rather like the second layer of security that SQL/Server ids
offer, although I do not like the fact that a SQL user (in v 4.21a at least)
can only belong to a single group.

I work in a three tier environment where I do the database and Web Server
stuff, departmental programmers do the creative stuff with HTML and then
departmental users enter or look up data via IIS.  I need a secure system
that allows me to be involved in lots of projects but only for the bare
minimum time that it takes to set up the SQL/Server tables, the *.IDC files
plus simple *.HTM and *.HTX sample files.  I might even write an automatic
HTML generator for that stuff.

I was hoping to give the department users NT read and execute permissions to
the *.HTM and *.HTX files, but just execute permission to the *.IDC files.
The departmental programmers would have full access to the *.HTM and *.HTX
files and do the fancy HTML formatting but also just have execute access to
the *.IDC files.  I would then give myself full access to everything.   I
even had a nice scheme worked out to keep the *.IDC files in separate
directories from the *.HTX and *.HTM files.  Unfortunately my research
indicates that IIS doesn't work that way.

First of all I have found out that every user of the IIS system needs to
have read access to the *.IDC files or they cannot use them to access
SQL/Server data.  Execute permission alone doesn't hack it.  That means that
all users (even the read only variety) must have read access to the *.IDC
files and can therefore 'see' the SQL/Server id and password written into
the *.IDC files.

Secondly, I have not had any success in separating the *.HTX and *.IDC files
into different directories.  Regardless of the permissions that I apply, the
*.IDC files only seem to work reliably with *.HTX files that are located in
the same directory.

The above has lead me to the following scheme which you might care to
consider and critique.

All of the files for a given project will be placed in a single subdirectory
under the /scripts/ directory.  The department users will be given an NT id
and password that allows read and execute for each of the HTM, HTX and IDC
files.  Department programmers will be provided with an NT id and password
that allows read and execute to the IDC files and full rights to the rest.
I would have full access to everything.

That does mean that the *.IDC id and password can be captured and read via a
standard Web browser by department users with IIS permissions but if I make
the SQL/Server id and password the same as that for the department user NT
account then nothing has been lost.  They already know that password and the
file is locked to other non-privileged users.  I just need to be very
careful with granting that account access to the particular SQL/Server
tables that participate in the project.

The above scheme can be extended to the general Web public by assigning a
special 'webguest' SQL/Server id and password to the *.IDC files that I
expose to the NT Internet Guest account established by IIS during installation.

If the above conflicts with your understanding or experience with IIS and
SQL/Server then I would appreciate hearing from you.



At 09:28 AM 3/21/96 -0500, you wrote:
>Technology is advancing and Web developers and sponsors are now
>realizing the significant role that SQL back-ends will play in
>the implementation of dynamic on-line content...
>
>SO HOW COME THE PULSE OF THIS FORUM IS SO WEAK  ????
>
>Are there other lists I should be looking at ?
>
>Do we need to re-jump-start interest in this space by promoting it's
>existence ?
>
>I am in the midst of preparing a white-paper on the features and
>benefits of the leading commercial WWW-RDB solutions for the Windows NT
>platform: Oracle, MeXt, MS ISS/SQL Server,  Sybase, Illustra, Cold
>Fusion, etc... and am interested in opening communications with others
>interested in the same.
>
>I will particularly appreciate any input from users/evaluators of
>any of those systems.
>
>I'm also intersted in organizing a SIG on the subject, any NY/NJ members
>of NYNMA, WWWAC, or IICS feel free to contact me to work on this.
>
>--------------------------------------------------------
>Technology Briefings              Database Architecture
>
>                   T/SA   L t d.
>
>Windows Programming           Client/Server Solutions
>
>                  tsaltd@panix.com
>                   (212) 343-0209
>---------------------------------------------------------
>
>

Received on Thursday, 21 March 1996 09:50:46 UTC