1

Our program ships with an SQL Server 2005 database and SQL Server 2005 Express. Usually it installs its own instance of SQL Server 2005 in the client's computer.

Now I have to add some tables whose content should only be updated from within the program. I need to prevent these tables from being changed directly, by using Management Studio for instance.

How can I achieve this? Should I set user permissions? Can I use encryption? I thought of setting my own 'sa' password for accessing the SQL Server instance and use it only from within the program, but that does not invalidate its access through Windows Authentication.

[Edit] Some clarification of what I'm trying to do. The program is a time and attendance program. The employees' clockings are collected from time clocks and saved in the database; once collected, these clockings cannot be deleted and their date and time values cannot be changed. So I need a way to prevent users from messing with these values directly in the database.

Bear in mind that the majority of our customers does not have any experience in SQL, so I need to have these permissions set upon program installation.

[Edit 2] Thank you for your answers, I would like to make two more questions related to this subject:

1 - Can I grant only SELECT permissions to those that access the DB through Windows Authentication?

2 - Is it possible/viable to protect a table against changes through a hash system? Like adding a hash column and calculate a hash for each row, then comparing the row data with the hash to check for changes?

4

4 回答 4

4

如果任何人具有 sa 级访问权限，您就无法阻止这一点。普通用户不应该有 sa 访问权限。

您可以通过授予帮助将其与普通用户隔离开来，例如，仅授予您的应用程序用户访问 INSERT、UPDATE、DELETE（或 EXECUTE，如果您使用存储过程而不是直接 SQL）的权限，并且仅授予其他用户 SELECT（或不）访问权限.

您可以做一些其他事情来分散临时用户的注意力，也许可以通过对插入/更新/删除的触发检查来强制这些操作仅由您的应用程序用户执行。我不会推荐它，但你可以做到。

于 2010-07-09T12:24:24.997 回答
3

您不能阻止本地管理员组的成员对您的数据库执行任何他们喜欢的操作。任何相反的说法都是蛇油。在这个时代，只需一个勇敢的用户找到改变数据的方法（例如，添加自己的时钟时间），从那时起，谷歌将确保每个感兴趣的用户都能找到破解方法。

绝大多数用户是他们使用的机器上的管理员组的成员。即使在最严格和最严格的公司强制执行组策略环境中，当涉及到该用户的薪水时，人们也不会梦想将敏感数据留在用户计算机上。

在用户计算机上设置防篡改数据存储，以防用户有篡改数据的动机，只是自找麻烦。集中存储数据，使用网络服务收集数据。

于 2010-07-09T20:03:19.717 回答
0

Are you able to use SQL Server Compact Edition instead of the Express? It is embedded into the app and is designed for this kind of scenario.

于 2010-07-09T20:30:30.383 回答
0

您可以在行级别向您的数据添加哈希检查，以便如果它被修改，每晚运行的篡改检查可以检测到它并发出警报。

于 2010-07-12T11:00:18.497 回答