How can i protect sqlserver 2000 by password

can any body tell me how can i protec my sqlserver 2000 by a
password so that no other person can open sqlserver 2000You should change passwords to all default User Ids.
To check which once you have, go to Users in Enterprise Manager.

Don't have anyone with NT authentication.

If you need users to be able to access through some front end application but still be prevented from getting directly to the server let me know.

I will provide some more sophisticated approach and preferably in private.

Thank you.|||i just want that no body can open my sqlserver 2000 directly to see
which database i am using and its tables/views etc

but any body can connect it by using programe which i made in
visual basic|||You have to hash passwords for each person before connecting to the server so they wouldn't really know the password that they use.
For the first time they login to your application you have to check if hashed password doesn't work you use sp_password command to change it to hashed password and in the future only hashed version will be used.
Also I provide functionality through my program where they can change their password. What I do, after they change a password I hash it first and then change it. So when they login next time they will again use hashed version and never know actual password to the server.
In this model you can not give NT authentication rights only password protected. Also you can check if the person who is logging in into your computer is the same as NT Login into this computer to provide your own authentication. This measure is made when you don't want people using somebody else's computers to login into your program.

Also all users of your application should be members of some group in my case I created enduser group. This way if you want to grant rights to something in a database that all users have access to from application like a view or stored procedure I just grant rights to that group and everyone has it instantly.
As I said if you wan to go with security model I created I can provide code samples in private.

Thank you.
Good Luck.sql

How can I protect my parameters?

Hello.
I have a report with parameter called "parm1", that gets a value of
"true" or "false" depanding on another parameter.
When the report is runnig the parm1 value is "false".
How can I protect this parameter from a change by the user?
I mean - the user can run the report and then add to the url "¶m1
= true".
Can I do anything against that?
I tried marking it as "internal" and I thought that now it can get his
value only from inside the report but it didn't worked.
Any ideas?
Thanks.Can you use session variables instead of a querystring?
On Oct 25, 12:54 pm, nicknack <roezo...@.gmail.com> wrote:
> Hello.
> I have a report with parameter called "parm1", that gets a value of
> "true" or "false" depanding on another parameter.
> When the report is runnig the parm1 value is "false".
> How can I protect this parameter from a change by the user?
> I mean - the user can run the report and then add to the url "¶m1
> = true".
> Can I do anything against that?
> I tried marking it as "internal" and I thought that now it can get his
> value only from inside the report but it didn't worked.
> Any ideas?
> Thanks.|||What do you mean by "session variables" ?
I didn't know there are "session variables" in reporting server.
Can you explain please?|||He is integrating his own website with RS. There is no session variables in
RS.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"nicknack" <roezohar@.gmail.com> wrote in message
news:1193337080.315943.85980@.z24g2000prh.googlegroups.com...
> What do you mean by "session variables" ?
> I didn't know there are "session variables" in reporting server.
> Can you explain please?
>|||If the point of this parameter is to use it as a query parameter then you
don't even need it as a report parameter.
Go to your dataset that uses this parameter, click on the ..., parameters
tab. This shows the mapping between query parameters and report parameters.
Change the mapping for this parameter to expression and put in the
expression that evaluates appropriately to true or false depending on the
other parameter. Then in the layout tab menu Reports->Report Parameters
delete the existing report parameter that is now not needed.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"nicknack" <roezohar@.gmail.com> wrote in message
news:1193331267.699414.296020@.k79g2000hse.googlegroups.com...
> Hello.
> I have a report with parameter called "parm1", that gets a value of
> "true" or "false" depanding on another parameter.
> When the report is runnig the parm1 value is "false".
> How can I protect this parameter from a change by the user?
> I mean - the user can run the report and then add to the url "¶m1
> = true".
> Can I do anything against that?
> I tried marking it as "internal" and I thought that now it can get his
> value only from inside the report but it didn't worked.
> Any ideas?
> Thanks.
>|||Hi Bruce,
Thanks for the idea.
Thats the best solution I have received so far.
To bad microsoft didn't thought about a simple way to protect the
parameter instead of beating around the bushes.
I'll try your solution soon.
Thanks again.|||"nicknack" <roezohar@.gmail.com> wrote in message
news:1193398666.577502.193620@.y42g2000hsy.googlegroups.com...
> Hi Bruce,
> Thanks for the idea.
> Thats the best solution I have received so far.
> To bad microsoft didn't thought about a simple way to protect the
> parameter instead of beating around the bushes.
Well, if you don't want the parameters (or even report URLs) to be visible
at all, why don't you use ReportViewer control INSIDE your page instead of
calling the whole page from SSRS?
Regards,
Dmitry|||Hi Dmitry,
Thanks for your replay but its not a solution.
I still can't understand how can it be that there isn't any way to
protected my parameters.
The report viewer control has his own problems and I really don't see
a reason to use a new ASPX page with another .net control instead of
just opening a new window with a report just because of this this bug
(and in my opinion it is a bug).
Amm, Sorry for taking it all on you but I'm really frustrated from
this issue.
On 27 , 15:45, "Dmitry Duginov" <d...@.nospam.nospam> wrote:
> "nicknack" <roezo...@.gmail.com> wrote in message
> news:1193398666.577502.193620@.y42g2000hsy.googlegroups.com...
> > Hi Bruce,
> > Thanks for the idea.
> > Thats the best solution I have received so far.
> > To bad microsoft didn't thought about a simple way to protect the
> > parameter instead of beating around the bushes.
> Well, if you don't want the parameters (or even report URLs) to be visible
> at all, why don't you use ReportViewer control INSIDE your page instead of
> calling the whole page from SSRS?
> Regards,
> Dmitry|||"nicknack" <roezohar@.gmail.com> wrote in message
news:1193518754.655684.319300@.o3g2000hsb.googlegroups.com...
> Hi Dmitry,
> Thanks for your replay but its not a solution.
> I still can't understand how can it be that there isn't any way to
> protected my parameters.
> The report viewer control has his own problems and I really don't see
> a reason to use a new ASPX page with another .net control instead of
> just opening a new window with a report just because of this this bug
> (and in my opinion it is a bug).
> Amm, Sorry for taking it all on you but I'm really frustrated from
> this issue.
Well, the way you are showing your report right now is called "URL
integration" if memory serves me right. That means that your report is 100%
relying on the URL string it is getting from the application, user or
someone/somebody else.
In the browser (surprise?), any URL is visible. No only your user can change
true to false, they can substitute different report name if you don't take
care about security.
It is generally a bad idea to expose any parameters that can be modified by
user, presenting security breach.
You said that the parameter in question (true/false) somehow depends on
another one, right? But your user can tweak that parameter as well, you
know...
Regards,
Dmitry|||On 29 , 16:00, "Dmitry Duginov" <d...@.nospam.nospam> wrote:
> "nicknack" <roezo...@.gmail.com> wrote in message
> news:1193518754.655684.319300@.o3g2000hsb.googlegroups.com...
> > Hi Dmitry,
> > Thanks for your replay but its not a solution.
> > I still can't understand how can it be that there isn't any way to
> > protected my parameters.
> > The report viewer control has his own problems and I really don't see
> > a reason to use a new ASPX page with another .net control instead of
> > just opening a new window with a report just because of this this bug
> > (and in my opinion it is a bug).
> > Amm, Sorry for taking it all on you but I'm really frustrated from
> > this issue.
> Well, the way you are showing your report right now is called "URL
> integration" if memory serves me right. That means that your report is 100%
> relying on the URL string it is getting from the application, user or
> someone/somebody else.
> In the browser (surprise?), any URL is visible. No only your user can change
> true to false, they can substitute different report name if you don't take
> care about security.
> It is generally a bad idea to expose any parameters that can be modified by
> user, presenting security breach.
> You said that the parameter in question (true/false) somehow depends on
> another one, right? But your user can tweak that parameter as well, you
> know...
> Regards,
> Dmitry
Hi again,
Thanks for your replay.
I see the logic behind your answer.
I will try to find another way to use the parameter.
Maybe by try to use a hidden textbox or something like that.
Thanks again.
Roy.|||Hi Bruce,
Just now I tried your solution again and understand what you meant.
It work fine and it is exactly what I wanted.
Thanks a lot,
Roy.
On 25 , 21:00, "Bruce L-C [MVP]" <bruce_lcNOS...@.hotmail.com>
wrote:
> If the point of this parameter is to use it as a query parameter then you
> don't even need it as a report parameter.
> Go to your dataset that uses this parameter, click on the ..., parameters
> tab. This shows the mapping between query parameters and report parameters.
> Change the mapping for this parameter to expression and put in the
> expression that evaluates appropriately to true or false depending on the
> other parameter. Then in the layout tab menu Reports->Report Parameters
> delete the existing report parameter that is now not needed.
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
> "nicknack" <roezo...@.gmail.com> wrote in message
> news:1193331267.699414.296020@.k79g2000hse.googlegroups.com...
> > Hello.
> > I have a report with parameter called "parm1", that gets a value of
> > "true" or "false" depanding on another parameter.
> > When the report is runnig the parm1 value is "false".
> > How can I protect this parameter from a change by the user?
> > I mean - the user can run the report and then add to the url "¶m1
> > = true".
> > Can I do anything against that?
> > I tried marking it as "internal" and I thought that now it can get his
> > value only from inside the report but it didn't worked.
> > Any ideas?
> > Thanks.|||Glad it worked for you.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"nicknack" <roezohar@.gmail.com> wrote in message
news:1194248091.562106.284270@.k79g2000hse.googlegroups.com...
> Hi Bruce,
> Just now I tried your solution again and understand what you meant.
> It work fine and it is exactly what I wanted.
> Thanks a lot,
> Roy.
> On 25 , 21:00, "Bruce L-C [MVP]" <bruce_lcNOS...@.hotmail.com>
> wrote:
>> If the point of this parameter is to use it as a query parameter then you
>> don't even need it as a report parameter.
>> Go to your dataset that uses this parameter, click on the ..., parameters
>> tab. This shows the mapping between query parameters and report
>> parameters.
>> Change the mapping for this parameter to expression and put in the
>> expression that evaluates appropriately to true or false depending on the
>> other parameter. Then in the layout tab menu Reports->Report Parameters
>> delete the existing report parameter that is now not needed.
>> --
>> Bruce Loehle-Conger
>> MVP SQL Server Reporting Services
>> "nicknack" <roezo...@.gmail.com> wrote in message
>> news:1193331267.699414.296020@.k79g2000hse.googlegroups.com...
>> > Hello.
>> > I have a report with parameter called "parm1", that gets a value of
>> > "true" or "false" depanding on another parameter.
>> > When the report is runnig the parm1 value is "false".
>> > How can I protect this parameter from a change by the user?
>> > I mean - the user can run the report and then add to the url "¶m1
>> > = true".
>> > Can I do anything against that?
>> > I tried marking it as "internal" and I thought that now it can get his
>> > value only from inside the report but it didn't worked.
>> > Any ideas?
>> > Thanks.
>