protecting access database

[sqlnerd]

Hi there!

My access database is part of a web application. The application will run from my client's server once installed (that is copied to the client's server and virtual directory created). I want to protect my database at client's server. I want to ensure that my application running at the client's place should be the only access point to the database. The client should not be able to open the database or even read the tables through any other appln. such as word, excel.

I have tried the following but in vain

1. setting password to the database... this is not fool proof. The Mailmerge facility in Word can still fetch the info from the database even if can not modify the data.

2. Encrypting the database does not solve the problem, too.

3. Generating an MDE file. This protects only modules written in Access. My application is purely ASP based and I am not writing any access modules. The MDE file can be opened with Access and it is not secure.

Is there any packaging mechnaism that makes my database fool proof.. or should i write my own encrypting/decrypting mechanism

Pl. help. I posted this on "Access other topics" forum, but didnt get any useful tip.

SQLNerd

 

[mvrijnsoever]

Hi SQLNerd

One way to do this, is making a separate workgroup file (MDW). You can do this using the Security wizard that is included in Microsoft Access 2000 (don't know for sure for pervious versions). Make sure that you do not give guest users any permissions otherwise anybody can log in.

After securing the database with a new workgroup file, Access make a shortcut like his:

"C:\Program Files\Microsoft Office\Office\MSACCESS.EXE" "C:\databases\somedatabase.mdb" /WRKGRP "C:\databases\workgroup.mdw"

Double clicking on the C:\databases\somedatabase.mdb does not work anymore because it does not use the specific workgroup file. Any other applications will also not use your workgroup file and therefore no other application will be able to read it directly. Still if you configure an ODBC driver to use your workgroup file, it can access it without problems (if you know the login and password combination). But if someone really wants to use a different application to open your database, there is no full prove way of stopping him once he has got the passwords.

But if someone wants to hack in the system, he will just use a password extraction tool. My work around is to use a MySQL server through a secure connection. As the password information is stored away from the user (instead of on his local hard drive).

Cheers,

Marius