IUSER Security Risk?

We have an old ASP application that authenticates to a SQL Server 2000 database using the IUSER account.

We are exploring the possibility of moving it to a DMZ so users can access from home. The IUSER account is being used for all database activity for this application. Is there any reason to be concerned about using IUSER as opposed to sql authentication for this tool, or any other security risks I should be wary of. Mind you there may be some sensitive information contained in the database. Thanks in advance.

I would recommend either application roles or some other security method, such as a middle-tier or at least SQL Server security to access the database rather than this user. For one thing, you can't track actions to an individual this way.

This is a good reference for what you are trying to do:

http://www.windowsecurity.com/articles/Secure_Architecture_SQL_Web_Server.html

IUSER Security Risk?

We have an old ASP application that authenticates to a SQL Server 2000 database using the IUSER account.

We are exploring the possibility of moving it to a DMZ so users can access from home. The IUSER account is being used for all database activity for this application. Is there any reason to be concerned about using IUSER as opposed to sql authentication for this tool, or any other security risks I should be wary of. Mind you there may be some sensitive information contained in the database. Thanks in advance.

I would recommend either application roles or some other security method, such as a middle-tier or at least SQL Server security to access the database rather than this user. For one thing, you can't track actions to an individual this way.

This is a good reference for what you are trying to do:

http://www.windowsecurity.com/articles/Secure_Architecture_SQL_Web_Server.html

sql

Issues running DTS Packages

Hello,

I have a sql 2005 cluster. I recently moved a new server in place of an old server we had

Both the servers now have w2k3 sp2 sql 2005 sp1 both have 2000 dts designer package.

My problem is that i have a dts package that runs on sql01\inst01 without any issues but the same package when i try to run it from sql02\inst02 just hangs ... digging deeper i found that - when i try to parse a query / build query / try giving parameters in a Execute SQL task it says

"The selected connection does not provide sql support"

The connection it reference is a postgres connection looking up info from a udl file.

I am not sure what is missing.

Any help is appreciated as soon as possible...

Resolved. Thanks

Issolation level

When on Oracle in one transaction I modify data when I select data on other transaction I get old data (until commit on first transaction)

Using MS SQL I must wait or I get (dirty read) modified values
Example:

Transaction no 1:
begin transaction
update ckk_klienci set kl_skrot = 'KLINTIN' where kl_id = 300000001
-- commit

Transaction no2:
select kl_skrot from ckk_klienci where kl_id = 300000001

Until there is no commit on Transaction no 1 transaction no 2 waits (gives no answer) lowering issolation level I can get new value

Is it possible to configure MS SQL as it works like Oracle

Thanks for halp
I want to know; I don't want to say that this is wrong; I just want to know if it is possibleRE [Quote][Size=1]
When on Oracle in one transaction I modify data when I select data on other transaction I get old data (until commit on first transaction)
Using MS SQL I must wait or I get (dirty read) modified values
Example:
Transaction no 1:
begin transaction
update ckk_klienci set kl_skrot = 'KLINTIN' where kl_id = 300000001
-- commit
Transaction no2:
select kl_skrot from ckk_klienci where kl_id = 300000001
Until there is no commit on Transaction no 1 transaction no 2 waits (gives no answer) lowering issolation level I can get new value
Is it possible to configure MS SQL as it works like Oracle
Thanks for halp
I want to know; I don't want to say that this is wrong; I just want to know if it is possible
[\Quote][\Size]

Q1 [Is it possible to configure MS SQL as it works like Oracle?]
A1 Obviously they are different products; however you can certainly control transaction isolation levels as appropriate / needed. For example:

Set Transaction Isolation Level Read Committed