OLEDB security

How secure is an OLEDB connection?

[tawny_owl]

We have a SQL database on the web which stores orders taken from our website.

I'm going to connect to this using MS Access running locally on an office PC, then query the SQL database.

Just wondering how secure the OLEDB connection is. How easy would it be for someone else to intercept the data?

Thanks in advance.

Al

[Easy_Coder]

oledb requires full trust which is the highest level on a machine (the opposite of good). Oh, and is the data encrypted?

[mrMister]

You'll be sending data, including your databse password unencrypted across the Internet. Anyone in control of a machine through which your packets pass could easily sniff the data if they were so inclined.

To secure the data you could tunnel the OleDb connection through SSH. An other option would be to connect directly to the machine rather than passing the data across the Internet.

[vincevincevince]

Or write a web-interface and run it on a properly secured SSL server

[aspdaddy]

You have 3 big problems with that approach 1) exposing SQL ports to the www, 2) using sql authentication 3) sending the user/pass and data over the web unencrpted.

An other option would be to connect directly to the machine rather than passing the data across the Internet.

What are you suggesting there? to just turn up at the hosting company ;)

[tawny_owl]

In response to aspdaddy's post, the SQL ports are already exposed to the www because I can connect to the server using SQL Enterprise Manager running on my PC. It seems to be my ISP's default setting.

How do I tunnel the OleDb connection through SSH as mrMister suggests?

Also, If I connected a local copy of SQL server - i.e. SQL Server to SQL Server, would this be any more secure than connecting Access to SQL Server?

[mrMister]

An other option would be to connect directly to the machine rather than passing the data across the Internet.

What are you suggesting there? to just turn up at the hosting company ;)

A direct link between two machines, Dial-up would be the cheapest (using point to point protocol). ISDN is another option and some companies do it with leased lines.

[edited by: mrMister at 6:20 pm (utc) on Sep. 14, 2006]

[aspdaddy]

you mean like using rasdial over PPTP?

[mrMister]

you mean like using rasdial over PPTP?

No I mean a direct PPP connection.

PPTP is PPP tunnelled via the Internet. I guess that'd work for the job as long as encryption was implemented, it'd be a similar solution to SSH tunneling.

[edited by: mrMister at 4:57 am (utc) on Sep. 21, 2006]