IUSR_WWW and db folder ?

[Dav.]

Hi guys,
I've always used a connection like this:

<%
' FileName="Connection_ado_conn_string.htm"
' Type="ADO"
' HTTP="true"
' Catalog=""
' Schema=""
MM_name_STRING = "DRIVER={Microsoft Access Driver
(*.mdb)};DBQ=F:/webspace/db.mdb;UID=login;PWD=password"
%>

I noticed that I use the IUSR_WWW account with full rights in the db folder,
so I asked myself: "and if I delete the UID and PWD fields ?" I deleted it
and all works correctly. SO WHY all say to enter UID and PWD ?? How can I
give this folder some SECURITY ? The IUSR user has full access, so someone
could also read and download my database.... isn't it ??

Thanks,

David.

[Aaron Bertrand - MVP]

> give this folder some SECURITY ? The IUSR user has full access, so someone

> could also read and download my database.... isn't it ??

Sure, if you tell them the name of the database, and what folder it's in.
If you keep this information private, they'd have to guess at it all...
which might be just as difficult as guessing your username/password to FTP
into your entire site structure (or term serv into the box itself!).

If you want to prevent the ability to download a lucky guess MDB file
location, keep your database in a non-web folder. You still have to make
sure IUSR_ has access to it, but end users won't be allowed to simply browse
to it.

If you want to prevent the ability to download the MDB file *but* keep it
accessible through FTP (and assuming you can't set up an FTP virtual
directory to your non-web folder, and maybe you can't set up a non-web
folder at all), simply give your Access database an .ASP extension. It
won't have a pretty Access icon anymore, but Access will still open it when
told, and users will not be able to download it.

A

[Dav.]

Does I need to give full control to the IUSR_WWW user or just read and write
?
Thanks,

David.
"Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> ha scritto nel messaggio
news:euUdFuhdDHA.1728@TK2MSFTNGP09.phx.gbl...

> > give this folder some SECURITY ? The IUSR user has full access, so

someone

> > could also read and download my database.... isn't it ??

>
> Sure, if you tell them the name of the database, and what folder it's in.
> If you keep this information private, they'd have to guess at it all...
> which might be just as difficult as guessing your username/password to FTP
> into your entire site structure (or term serv into the box itself!).
>
> If you want to prevent the ability to download a lucky guess MDB file
> location, keep your database in a non-web folder. You still have to make
> sure IUSR_ has access to it, but end users won't be allowed to simply

browse

> to it.
>
> If you want to prevent the ability to download the MDB file *but* keep it
> accessible through FTP (and assuming you can't set up an FTP virtual
> directory to your non-web folder, and maybe you can't set up a non-web
> folder at all), simply give your Access database an .ASP extension. It
> won't have a pretty Access icon anymore, but Access will still open it

when

> told, and users will not be able to download it.
>
> A
>
>

[Bob Barrows]

Just read/write (Change). The permissions need to apply to the folder
containing the mdb file, not just to the file, because users of and mdb file
need to be able to create and delete the corresponding ldb file within the
same folder.

Bob Barrows

Dav. wrote:

> Does I need to give full control to the IUSR_WWW user or just read
> and write ?
> Thanks,
>
> David.
> "Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> ha scritto nel
> messaggio news:euUdFuhdDHA.1728@TK2MSFTNGP09.phx.gbl...

>>> give this folder some SECURITY ? The IUSR user has full access, so
>>> someone could also read and download my database.... isn't it ??

>>
>> Sure, if you tell them the name of the database, and what folder
>> it's in. If you keep this information private, they'd have to guess
>> at it all... which might be just as difficult as guessing your
>> username/password to FTP into your entire site structure (or term
>> serv into the box itself!).
>>
>> If you want to prevent the ability to download a lucky guess MDB file
>> location, keep your database in a non-web folder. You still have to
>> make sure IUSR_ has access to it, but end users won't be allowed to
>> simply browse to it.
>>
>> If you want to prevent the ability to download the MDB file *but*
>> keep it accessible through FTP (and assuming you can't set up an FTP
>> virtual directory to your non-web folder, and maybe you can't set up
>> a non-web folder at all), simply give your Access database an .ASP
>> extension. It won't have a pretty Access icon anymore, but Access
>> will still open it when told, and users will not be able to download
>> it.
>>
>> A

[Jeff Cochran]

On Mon, 8 Sep 2003 16:48:26 +0200, "Dav." <funnyboy@interfree.it>
wrote:

>Hi guys,
>I've always used a connection like this:
>
><%
>' FileName="Connection_ado_conn_string.htm"
>' Type="ADO"
>' HTTP="true"
>' Catalog=""
>' Schema=""
>MM_name_STRING = "DRIVER={Microsoft Access Driver
>(*.mdb)};DBQ=F:/webspace/db.mdb;UID=login;PWD=password"
>%>
>
>I noticed that I use the IUSR_WWW account with full rights in the db folder,
>so I asked myself: "and if I delete the UID and PWD fields ?" I deleted it
>and all works correctly. SO WHY all say to enter UID and PWD ?? How can I
>give this folder some SECURITY ? The IUSR user has full access, so someone
>could also read and download my database.... isn't it ??

Put the database folder outside the web structure and it won't be
served by IIS on any HTTP request.

Jeff