IUSR Role in SQL Server Database

Is it a security risk to have the IUSR account set up as a dbo, or is it
better to give the IUSR account selected authority? I use the IUSR account
to access SQL Server for ASP web pages. The connection string uses
IUSR_<machine> with no password, but the password is stored within IIS.
Hi
Bad idea to give that user DBO. If a hacker gets though your web pages, he
can do anything to your database.
Always give users explicit permission (never to tables, but to stored
procedures), and give the least permissions you can.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"WC Justice" <BJustice@.wcje.com> wrote in message
news:%W2qe.73996$6k7.73701@.bignews4.bellsouth.net. ..
> Is it a security risk to have the IUSR account set up as a dbo, or is it
> better to give the IUSR account selected authority? I use the IUSR
> account to access SQL Server for ASP web pages. The connection string
> uses IUSR_<machine> with no password, but the password is stored within
> IIS.
>

IUSR Role in SQL Server Database

Is it a security risk to have the IUSR account set up as a dbo, or is it
better to give the IUSR account selected authority? I use the IUSR account
to access SQL Server for ASP web pages. The connection string uses
IUSR_<machine> with no password, but the password is stored within IIS.Hi
Bad idea to give that user DBO. If a hacker gets though your web pages, he
can do anything to your database.
Always give users explicit permission (never to tables, but to stored
procedures), and give the least permissions you can.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"WC Justice" <BJustice@.wcje.com> wrote in message
news:%W2qe.73996$6k7.73701@.bignews4.bellsouth.net...
> Is it a security risk to have the IUSR account set up as a dbo, or is it
> better to give the IUSR account selected authority? I use the IUSR
> account to access SQL Server for ASP web pages. The connection string
> uses IUSR_<machine> with no password, but the password is stored within
> IIS.
>

IUSER Security Risk?

We have an old ASP application that authenticates to a SQL Server 2000 database using the IUSER account.

We are exploring the possibility of moving it to a DMZ so users can access from home. The IUSER account is being used for all database activity for this application. Is there any reason to be concerned about using IUSER as opposed to sql authentication for this tool, or any other security risks I should be wary of. Mind you there may be some sensitive information contained in the database. Thanks in advance.

I would recommend either application roles or some other security method, such as a middle-tier or at least SQL Server security to access the database rather than this user. For one thing, you can't track actions to an individual this way.

This is a good reference for what you are trying to do:

http://www.windowsecurity.com/articles/Secure_Architecture_SQL_Web_Server.html

IUSER Security Risk?

We have an old ASP application that authenticates to a SQL Server 2000 database using the IUSER account.

We are exploring the possibility of moving it to a DMZ so users can access from home. The IUSER account is being used for all database activity for this application. Is there any reason to be concerned about using IUSER as opposed to sql authentication for this tool, or any other security risks I should be wary of. Mind you there may be some sensitive information contained in the database. Thanks in advance.

I would recommend either application roles or some other security method, such as a middle-tier or at least SQL Server security to access the database rather than this user. For one thing, you can't track actions to an individual this way.

This is a good reference for what you are trying to do:

http://www.windowsecurity.com/articles/Secure_Architecture_SQL_Web_Server.html

sql