IUSR Web Access to DB - Separate Servers

I have NT SQL 7 and Web Server on same box. I have a new server with W2K and SQL 2000 installed (no IIS). I am migrating the databases over and when done I will install W2K on the old box and it will remain the IIS Web server front end to the new SQL 2000 Server.

On the old configuration, IIS and SQL 7 on the same box, I added the IUSER to the database from the local computer users list when needed for web access. How do I add that user now that the boxes are seperate? The acccout is not a local account on the new machine and the account is a loca account on the other machine so it does not authenticate to the domain so I can't pull it in from there.

Thanks for any help.

--Steve

ssantos@.csuchico.eduSimple answer is to use SQL Authentication.

Create a SQL user on your SQL box, then use a non-SSPI connection in your ASP/ASPX.

More complicated, but ultimately better answer:
Create a new domain user, give it the same permissions on the IIS machine as the IUSER, restrict it's permissions elsewhere on the domain, then add them as a database user in the SQL box.

IUSR Role in SQL Server Database

Is it a security risk to have the IUSR account set up as a dbo, or is it
better to give the IUSR account selected authority? I use the IUSR account
to access SQL Server for ASP web pages. The connection string uses
IUSR_<machine> with no password, but the password is stored within IIS.
Hi
Bad idea to give that user DBO. If a hacker gets though your web pages, he
can do anything to your database.
Always give users explicit permission (never to tables, but to stored
procedures), and give the least permissions you can.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"WC Justice" <BJustice@.wcje.com> wrote in message
news:%W2qe.73996$6k7.73701@.bignews4.bellsouth.net. ..
> Is it a security risk to have the IUSR account set up as a dbo, or is it
> better to give the IUSR account selected authority? I use the IUSR
> account to access SQL Server for ASP web pages. The connection string
> uses IUSR_<machine> with no password, but the password is stored within
> IIS.
>

IUSR Role in SQL Server Database

Is it a security risk to have the IUSR account set up as a dbo, or is it
better to give the IUSR account selected authority? I use the IUSR account
to access SQL Server for ASP web pages. The connection string uses
IUSR_<machine> with no password, but the password is stored within IIS.Hi
Bad idea to give that user DBO. If a hacker gets though your web pages, he
can do anything to your database.
Always give users explicit permission (never to tables, but to stored
procedures), and give the least permissions you can.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"WC Justice" <BJustice@.wcje.com> wrote in message
news:%W2qe.73996$6k7.73701@.bignews4.bellsouth.net...
> Is it a security risk to have the IUSR account set up as a dbo, or is it
> better to give the IUSR account selected authority? I use the IUSR
> account to access SQL Server for ASP web pages. The connection string
> uses IUSR_<machine> with no password, but the password is stored within
> IIS.
>