Re: Security and the ODBC

Nils.Myklebust@idg.no (Nils Myklebust) wrote: >So the user should supply an extra password for the role I asume. That >in itself is bad, but may be it could be the same as the password to >get into the database (the Unix users password for Informix). In that >case this would be ok. No the password should be unknown to the user - of course there is no way to keep role names secret, it is the same as usernames. The program should have a way to retireive _its_ password the way a user can't. On UNIX the program could be suid . On WinNT/Win95 you could brand the program with the password and put it on a network drive, that supports execute only (no read) access. But iI admit these are only solutions for inhouse programming. The only thing to be inaccessable is the role-password (of course that can be areal administrative burden). For me this role scheme is just a way for the __APPLICATION__ to authorize itself __INDEPENDENDLY__ from the user. >The only real solution is at the connection level where program names, >application names, machine/terminal names and other things should be >checked before access is granted at some level. I think program names are useless, since if I use an Win* client, I can give the program any name i want it so no server on the other side of the network can find out the difference . The other things can be a bit more interesting: The database connection software could send a crc of the program to the server and the server would check if the program is registered. Greetings Harald Ums Harald Ums Tel : +49 (0)89-9507-5140 PRO 7 Televisions GmbH Fax : +49 (0)89-9507-5191 Bahnhofstra'e 28 D-80767 Unterf'hring e-mail: Harald.Ums@sevensys.de