July 30, 2010     |
Network Toaster
SQL Security Forums
Note: SQLSecurity.com does not allow nor require registration due to privacy concerns for users. SQLSecurity.com is open and anonymous for all. Please report any abuse or profanity.
Subject: DNN and SQL Server 2005 security
Prev Next

Author Messages
Zuf (guest)

07/10/2006 1:40 PM Quote Reply Alert 
Hi,

I'm always reluctant to give any application user 'dbo' rights to a database, so when implementing a DNN4 site I was upset to find the official setup is to give the user 'dbo'.

Is there anyone out there who has found what roles/permissions are enough to have a fully working site without giving them everything?

Thanks
Chip Andrews (guest)

07/10/2006 7:16 PM Quote Reply Alert 
Unfortunately DNN uses DBO rights to create objects on the fly (which needs to be done when adding new modules, etc) but does differentiate between "runtime" rights and install rights.

It could just as easily have two sets of SQL Server credentials - one for module install (or other install activities) and one for runtime.

Please be sure to make this suggestion at the DNN development site. If enough of us suggest it - it's bound to happen. It's been one of my pet peevs as well.

Chip
Zuf (guest)

07/11/2006 1:44 PM Quote Reply Alert 
Not really the answer I was after :-) , but at least I now know what I'm up against.
Thanks for the quick reply. I'll pass my thoughts onto the DNN boys.
mulhall (guest)

07/12/2006 12:47 AM Quote Reply Alert 
Anything wrong with db_ddladmin?

Of course you'll have to be wary of ownership issues.

Forums > Discussions > SQL Server Security > DNN and SQL Server 2005 security

Quick Reply
Username:  
Subject:  
Body:
 



ActiveForums 3.6
Copyright 1999 by Chip Andrews   |  Privacy Statement  |  Terms Of Use