Precautions 1

[Memento]

I have SQL Server 2000 that has a five databases on it. I have a vendor who needs access to this server since his database now resides on it. We have a VPN connection to allow him through, but I am unsure on what security precautions I need to take care of before I give him access. I also now have the ability to allow him to connect through Terminal Server. Ideally, I'd like him to only be able to go to HIS database.

In short, what is the most secure method of allowing him TS or VPN, and limiting him to only his database.

Windows 2003 Server
Sql Server 2000

 

[thendrickson]

Create a group with permissions only to his database (and only the permissions he actually needs).

Assign each user in his company to that group.

Do not permit him to use a single log on for all users if you can avoid doing so.

Do not permit him to log in as 'sa', even if he needs admin permissions.

You might consider giving him 2 groups

example: VendorAdmin with administrator rights
members DDuck
MMouse

Vendor User with read only rights or whatever
members Bozo
BRabbit
etc, etc

 

[Memento]

Thanks for the post.

You've given me a good starting point. I definitely will not give him the sa.