Session Session VDA306 VDA306 Dealing with SQL Security Dealing with SQL Security from ADO.NET from ADO.NET Fernando G. Guerrero Fernando G. Guerrero SQL Server MVP SQL Server MVP .NET Technical Lead .NET Technical Lead QA plc QA plc October 2002 October 2002
An old presentation from 2002, on security and .NET development
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Session Session VDA306VDA306
Dealing with SQL Security Dealing with SQL Security from ADO.NETfrom ADO.NET
Fernando G. GuerreroFernando G. GuerreroSQL Server MVPSQL Server MVP
• SQL Server Authentication modes• Access to SQL Server Databases• Application security using SQL Server 2000
and ADO.NET
• Note: as this is a VS.NET session, I’ll show you as much ADO.NET, VB.NET and SQL-DMO code as possible, but you need to know about how SQL Server deals with security as well
VS.NET Connections
SQL Server Authentication modesSQL Server Authentication modes
• SQL Server Authentication– SQL Server specific logins
– Not recommended for Windows users
– Specify UID/PWD in the ConnectionString
• Windows integrated– Create logins for Windows groups, not users
– Deny access to SQL Server by creating Windows logins in SQL Server
– Specify Trusted_Connection=true in the ConnectionString
VS.NET Connections
SQL Server AuthenticationSQL Server Authentication
• Easy to understand• Independent of the Windows Domain structure• Not too flexible• Easier to break• Connection pooling unfriendly
VS.NET Connections
SQL Server Authentication (2)SQL Server Authentication (2)
• Most applications still connect as sa and no password (or password as password)
• Could provide an extra layer of authentication• IIS+NT friendly• If you write your UID/PWD in the connection
string, someone could read it• Connection pooling friendly
VS.NET Connections
How to create SQL Server How to create SQL Server logins programmatically from logins programmatically from
Visual Basic .NET (demo)Visual Basic .NET (demo)
VS.NET Connections
Windows AuthenticationWindows Authentication
• Easier to administer in the long run
• Complex security combinations– NT Groups to reflect actual business structure– Combinations of groups give actual
permissions
• Comprehensive security control based on Windows NT / 2000 / .NET security:– Password policies– Location and time control
– Automatic account blocking
VS.NET Connections
Windows Authentication (2)Windows Authentication (2)
• Grant access to lots of users in a single shot
• Deny access to lots of users in a single shot too
• Make code easier to deploy and maintain
• You don’t write your UID/PWD in the connection string, so it is more difficult to hack
VS.NET Connections
Connection Strings and Connection Strings and Windows authentication in Windows authentication in
ADO.NET (demo)ADO.NET (demo)
VS.NET Connections
How to create programmatically How to create programmatically Windows logins in SQL Server Windows logins in SQL Server 2000 from Visual Basic .NET 2000 from Visual Basic .NET
(demo)(demo)
VS.NET Connections
Using SQL-DMO from VB.NET to Using SQL-DMO from VB.NET to manage the authentication manage the authentication
mode, and SQL Server securitymode, and SQL Server security
• In this demonstration you will see how to:– Change the SQL Server Authentication
Mode– Manage SQL Server logins
• And we will do it by using VB.NET with:– SQL-DMO– SQLCommand objects
VS.NET Connections
The nasty error 18452 The nasty error 18452
• SQL Server is configured for Windows Authentication only:– Not even the sa can login
• Before changing to Mixed authentication mode, give a strong password to the sa login!
VS.NET Connections
What if you dropped the What if you dropped the Builtin/Administrators login?Builtin/Administrators login?
• Unless you have a valid login to access SQL Server, you are into troubles
• You can start a new session using the Windows service account and create the appropriate logins
• Or edit the registry and change the value of the following key to 2:– Default instance:
• Your application can authenticate users from login/password data
• Store open login, encrypted password
• Compare encrypted passwords• Create the entire thing as system
objects
VS.NET Connections
Do you want to know more?Do you want to know more?• “Inside SQL Server 2000” (Kalen Delaney, MSPress)• “Advanced Transact-SQL for SQL Server 2000” (Itzik Ben-
Gan & Tom Moreau, APress)• “SQL Server 2000 Programming” (Robert Vieira, WROX)• “Microsoft SQL Server 2000 Programming by Example”
(Fernando G. Guerrero & Carlos Eduardo Rojas, QUE)
• “System.Data: A Clockwork Link between VB.NET and SQL Server ” (Fernando G. Guerrero, Apress)
• SQL Server 2000 Resource Kit (MSPress & TechNet)• Visit the Microsoft public newsgroups: