Access Database Security On The Web   (Part 2)

Alistair Hamilton from Beta-microSolutions came up with more information which the ISP quickly amended to stop the problem with the possible download of the database.   This is summarised as follows

The Microsoft Knowledge Base Article is not going to stop the file being downloaded. It simply incorporates Access security mechanisms and makes them available over the Net.

The statement from your ISP is incorrect. The anonymous Web user account on the ISP server needs file system read and write permissions to the database directory and file. This is necessary to allow records to be read and written to the database by the user through asp and ODBC. The reason that your file is being downloaded is because your ISP has left your database file directory Web permissions set to read (as opposed to file permissions). It's this that causes the file to be downloaded when you enter the full URL.

Just to reiterate, the database file and its directory should have file system access permissions to allow reading and writing to/from the database. (The directory needs read/write permissions because ODBC needs to be able to create and access the LDB file). Web read/write permissions should NOT be allowed within the Web Server software for the
database directory.

Though the four suggestions you make are correct and eminently sensible can I make the following additional suggestions?

Do NOT allow directory browsing or indexing of the directory. (The same applies to any asp folder). On our Intranet server, we also disable web read permissions for the asp folder. (At the time of writing I haven't checked if our ISP has set this). Our understanding is the anonymous user does not need read web access to this, only script or execute access, as the process is run internally by the server software - as long as execute/script permissions are enabled of course. (It works for the asp scripts we use on our Intranet, which are primarily modified MS FrontPage Database
Region Wizard generated scripts. Unless there is something peculiar to the way FrontPage Server Extensions and ASPs are run by MS Internet Information Server, I see no reason why this would be different for scripts produced using some other method).

This information is based on my knowledge of MS Windows NT Server and MS Internet Information Server which is used by both us and our ISP. Whilst I see no reason why this information wouldn't be applicable to other systems, I cannot vouch for that.




Alistair Hamilton
Beta-microSolutions
www.beta-microsolutions.co.uk