Access to internal database

[CMan]

Hi ,

We have a internal database application which we now need to update from a
website hosted at an external site.

We want users to be able to come to the website and see their very latest
information. They should be able to update this data and submit it to a
holding area before it is checked by an operator and the live record
updated.

What is the best and most secure way to achieve this scenario?
How should the website be connected to the internal database?

Thanks

CMan

[Cowboy (Gregory A. Beamer) - MVP]

The most secure is to set up each "user" as an NT account and force login.
This can end up as a maintenance nightmare, however. Outside of this, you
will have to create some form of security account table for each user of the
system. You can set up an admin role and user roles and have the admin for a
particular company control the user's access. That will take some of the
maintenance off your back. You will have to add these new tables (account,
role, etc.) to your database or a separate security database.

All db access should be done through stored procedures, if possible, as that
adds a security layer over ad hoc queries against tables. A "hacker" will
only have access to the data retrieved, updated, etc., by a procedure, which
you have control over. This is not possible with all types of databases.

---

Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

***************************
Think Outside the Box!
***************************


"CMan" wrote:

> Hi ,
>
> We have a internal database application which we now need to update from a
> website hosted at an external site.
>
> We want users to be able to come to the website and see their very latest
> information. They should be able to update this data and submit it to a
> holding area before it is checked by an operator and the live record
> updated.
>
> What is the best and most secure way to achieve this scenario?
> How should the website be connected to the internal database?
>
> Thanks
>
> CMan
>
>
>

[Eliyahu Goldin]

If you are in Microsoft environment, you need to publish your database out
on your local ISA server. You can allow external access from only one
location, which is the webserver. The web server then would connect to the
database server by the ISA IP address. If you are going to pass secure data
between the web and database server, you will want to equip the database
server with a SSL certificate.

Eliyahu

"CMan" <cman@nospam.nospam> wrote in message
news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...

> Hi ,
>
> We have a internal database application which we now need to update from a
> website hosted at an external site.
>
> We want users to be able to come to the website and see their very latest
> information. They should be able to update this data and submit it to a
> holding area before it is checked by an operator and the live record
> updated.
>
> What is the best and most secure way to achieve this scenario?
> How should the website be connected to the internal database?
>
> Thanks
>
> CMan
>
>

[chanmmn]

[url]http://msdn.microsoft.com/architecture/application/default.aspx[/url]

chanmm

"CMan" <cman@nospam.nospam> wrote in message
news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...

> Hi ,
>
> We have a internal database application which we now need to update from a
> website hosted at an external site.
>
> We want users to be able to come to the website and see their very latest
> information. They should be able to update this data and submit it to a
> holding area before it is checked by an operator and the live record
> updated.
>
> What is the best and most secure way to achieve this scenario?
> How should the website be connected to the internal database?
>
> Thanks
>
> CMan
>
>

[CMan]

Thanks everyone,

So we can make the connection to the database server over SSL? Or do you
just mean between the web server and browser?
How do we set this up? Is it a simple SQL Server setting or win2000 network
setting?

How does SSL compare to using IPsec?
Can this all be done securely through win2000 alone or is third party
software required/preferred?

Thanks in advance.

CMan







"Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
news:eQLKiRnxEHA.2012@TK2MSFTNGP15.phx.gbl...

> If you are in Microsoft environment, you need to publish your database out
> on your local ISA server. You can allow external access from only one
> location, which is the webserver. The web server then would connect to the
> database server by the ISA IP address. If you are going to pass secure

data

> between the web and database server, you will want to equip the database
> server with a SSL certificate.
>
> Eliyahu
>
> "CMan" <cman@nospam.nospam> wrote in message
> news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...

> > Hi ,
> >
> > We have a internal database application which we now need to update from

a

> > website hosted at an external site.
> >
> > We want users to be able to come to the website and see their very

latest

> > information. They should be able to update this data and submit it to a
> > holding area before it is checked by an operator and the live record
> > updated.
> >
> > What is the best and most secure way to achieve this scenario?
> > How should the website be connected to the internal database?
> >
> > Thanks
> >
> > CMan
> >
> >

>
>

[Eliyahu Goldin]

Yes, you can make SSL connection between the database server and the
webserver if you install a SSL certificate on the database server.

Microsoft document "Building Secure ASP.NET Applications" is a good strating
point. Can be downloaded from
[url]http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=055FF772-97FE-41B8-A58C-BF9C6593F25E[/url]

Eliyahu

"CMan" <cman@nospam.nospam> wrote in message
news:uPvGRlxxEHA.1400@TK2MSFTNGP11.phx.gbl...

> Thanks everyone,
>
> So we can make the connection to the database server over SSL? Or do you
> just mean between the web server and browser?
> How do we set this up? Is it a simple SQL Server setting or win2000

network

> setting?
>
> How does SSL compare to using IPsec?
> Can this all be done securely through win2000 alone or is third party
> software required/preferred?
>
> Thanks in advance.
>
> CMan
>
>
>
>
>
>
>
> "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> news:eQLKiRnxEHA.2012@TK2MSFTNGP15.phx.gbl...

> > If you are in Microsoft environment, you need to publish your database

out

> > on your local ISA server. You can allow external access from only one
> > location, which is the webserver. The web server then would connect to

the

> > database server by the ISA IP address. If you are going to pass secure

> data

> > between the web and database server, you will want to equip the database
> > server with a SSL certificate.
> >
> > Eliyahu
> >
> > "CMan" <cman@nospam.nospam> wrote in message
> > news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...

> > > Hi ,
> > >
> > > We have a internal database application which we now need to update

from

> a

> > > website hosted at an external site.
> > >
> > > We want users to be able to come to the website and see their very

> latest

> > > information. They should be able to update this data and submit it to

a

> > > holding area before it is checked by an operator and the live record
> > > updated.
> > >
> > > What is the best and most secure way to achieve this scenario?
> > > How should the website be connected to the internal database?
> > >
> > > Thanks
> > >
> > > CMan
> > >
> > >

> >
> >

>
>

[CMan]

Thanks Eliyahu,

This has been really helpful.

For this use would there be any problem generating our own certificate>

CMan



"Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
news:uU4Rh9xxEHA.484@TK2MSFTNGP09.phx.gbl...

> Yes, you can make SSL connection between the database server and the
> webserver if you install a SSL certificate on the database server.
>
> Microsoft document "Building Secure ASP.NET Applications" is a good

strating

> point. Can be downloaded from
>

[url]http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=055FF772-97FE-41B8-A58C-BF9C6593F25E[/url]

>
> Eliyahu
>
> "CMan" <cman@nospam.nospam> wrote in message
> news:uPvGRlxxEHA.1400@TK2MSFTNGP11.phx.gbl...

> > Thanks everyone,
> >
> > So we can make the connection to the database server over SSL? Or do

you

> > just mean between the web server and browser?
> > How do we set this up? Is it a simple SQL Server setting or win2000

> network

> > setting?
> >
> > How does SSL compare to using IPsec?
> > Can this all be done securely through win2000 alone or is third party
> > software required/preferred?
> >
> > Thanks in advance.
> >
> > CMan
> >
> >
> >
> >
> >
> >
> >
> > "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> > news:eQLKiRnxEHA.2012@TK2MSFTNGP15.phx.gbl...

> > > If you are in Microsoft environment, you need to publish your database

> out

> > > on your local ISA server. You can allow external access from only one
> > > location, which is the webserver. The web server then would connect to

> the

> > > database server by the ISA IP address. If you are going to pass secure

> > data

> > > between the web and database server, you will want to equip the

database

> > > server with a SSL certificate.
> > >
> > > Eliyahu
> > >
> > > "CMan" <cman@nospam.nospam> wrote in message
> > > news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...
> > > > Hi ,
> > > >
> > > > We have a internal database application which we now need to update

> from

> > a

> > > > website hosted at an external site.
> > > >
> > > > We want users to be able to come to the website and see their very

> > latest

> > > > information. They should be able to update this data and submit it

to

> a

> > > > holding area before it is checked by an operator and the live record
> > > > updated.
> > > >
> > > > What is the best and most secure way to achieve this scenario?
> > > > How should the website be connected to the internal database?
> > > >
> > > > Thanks
> > > >
> > > > CMan
> > > >
> > > >
> > >
> > >

> >
> >

>
>

[Eliyahu Goldin]

Theoretically there should not be any problem. Never did it myself though.

Eliyahu

"CMan" <cman@nospam.nospam> wrote in message
news:%23j7vKt%23xEHA.2876@TK2MSFTNGP12.phx.gbl...

> Thanks Eliyahu,
>
> This has been really helpful.
>
> For this use would there be any problem generating our own certificate>
>
> CMan
>
>
>
> "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> news:uU4Rh9xxEHA.484@TK2MSFTNGP09.phx.gbl...

> > Yes, you can make SSL connection between the database server and the
> > webserver if you install a SSL certificate on the database server.
> >
> > Microsoft document "Building Secure ASP.NET Applications" is a good

> strating

> > point. Can be downloaded from
> >

>

[url]http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=055FF772-97FE-41B8-A58C-BF9C6593F25E[/url]

> >
> > Eliyahu
> >
> > "CMan" <cman@nospam.nospam> wrote in message
> > news:uPvGRlxxEHA.1400@TK2MSFTNGP11.phx.gbl...

> > > Thanks everyone,
> > >
> > > So we can make the connection to the database server over SSL? Or do

> you

> > > just mean between the web server and browser?
> > > How do we set this up? Is it a simple SQL Server setting or win2000

> > network

> > > setting?
> > >
> > > How does SSL compare to using IPsec?
> > > Can this all be done securely through win2000 alone or is third party
> > > software required/preferred?
> > >
> > > Thanks in advance.
> > >
> > > CMan
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> > > news:eQLKiRnxEHA.2012@TK2MSFTNGP15.phx.gbl...
> > > > If you are in Microsoft environment, you need to publish your

database

> > out

> > > > on your local ISA server. You can allow external access from only

one

> > > > location, which is the webserver. The web server then would connect

to

> > the

> > > > database server by the ISA IP address. If you are going to pass

secure

> > > data
> > > > between the web and database server, you will want to equip the

> database

> > > > server with a SSL certificate.
> > > >
> > > > Eliyahu
> > > >
> > > > "CMan" <cman@nospam.nospam> wrote in message
> > > > news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...
> > > > > Hi ,
> > > > >
> > > > > We have a internal database application which we now need to

update

> > from

> > > a
> > > > > website hosted at an external site.
> > > > >
> > > > > We want users to be able to come to the website and see their very
> > > latest
> > > > > information. They should be able to update this data and submit it

> to

> > a

> > > > > holding area before it is checked by an operator and the live

record

> > > > > updated.
> > > > >
> > > > > What is the best and most secure way to achieve this scenario?
> > > > > How should the website be connected to the internal database?
> > > > >
> > > > > Thanks
> > > > >
> > > > > CMan
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >

> >
> >

>
>

[CMan]

Thanks.


"Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
news:u$oZkG$xEHA.2012@TK2MSFTNGP15.phx.gbl...

> Theoretically there should not be any problem. Never did it myself though.
>
> Eliyahu
>
> "CMan" <cman@nospam.nospam> wrote in message
> news:%23j7vKt%23xEHA.2876@TK2MSFTNGP12.phx.gbl...

> > Thanks Eliyahu,
> >
> > This has been really helpful.
> >
> > For this use would there be any problem generating our own certificate>
> >
> > CMan
> >
> >
> >
> > "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> > news:uU4Rh9xxEHA.484@TK2MSFTNGP09.phx.gbl...

> > > Yes, you can make SSL connection between the database server and the
> > > webserver if you install a SSL certificate on the database server.
> > >
> > > Microsoft document "Building Secure ASP.NET Applications" is a good

> > strating

> > > point. Can be downloaded from
> > >

> >

>

[url]http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=055FF772-97FE-41B8-A58C-BF9C6593F25E[/url]

> > >
> > > Eliyahu
> > >
> > > "CMan" <cman@nospam.nospam> wrote in message
> > > news:uPvGRlxxEHA.1400@TK2MSFTNGP11.phx.gbl...
> > > > Thanks everyone,
> > > >
> > > > So we can make the connection to the database server over SSL? Or

do

> > you

> > > > just mean between the web server and browser?
> > > > How do we set this up? Is it a simple SQL Server setting or win2000
> > > network
> > > > setting?
> > > >
> > > > How does SSL compare to using IPsec?
> > > > Can this all be done securely through win2000 alone or is third

party

> > > > software required/preferred?
> > > >
> > > > Thanks in advance.
> > > >
> > > > CMan
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > "Eliyahu Goldin" <removemeegoldin@monarchmed.com> wrote in message
> > > > news:eQLKiRnxEHA.2012@TK2MSFTNGP15.phx.gbl...
> > > > > If you are in Microsoft environment, you need to publish your

> database

> > > out
> > > > > on your local ISA server. You can allow external access from only

> one

> > > > > location, which is the webserver. The web server then would

connect

> to

> > > the
> > > > > database server by the ISA IP address. If you are going to pass

> secure

> > > > data
> > > > > between the web and database server, you will want to equip the

> > database

> > > > > server with a SSL certificate.
> > > > >
> > > > > Eliyahu
> > > > >
> > > > > "CMan" <cman@nospam.nospam> wrote in message
> > > > > news:%23WG3iInxEHA.3376@TK2MSFTNGP12.phx.gbl...
> > > > > > Hi ,
> > > > > >
> > > > > > We have a internal database application which we now need to

> update

> > > from
> > > > a
> > > > > > website hosted at an external site.
> > > > > >
> > > > > > We want users to be able to come to the website and see their

very

> > > > latest
> > > > > > information. They should be able to update this data and submit

it

> > to

> > > a
> > > > > > holding area before it is checked by an operator and the live

> record

> > > > > > updated.
> > > > > >
> > > > > > What is the best and most secure way to achieve this scenario?
> > > > > > How should the website be connected to the internal database?
> > > > > >
> > > > > > Thanks
> > > > > >
> > > > > > CMan
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >

> >
> >

>
>