Dear all experts,
We have an ASP application previously deployed on machine A, where the web
server (W2K-IIS) and database server (SQLServer 7.0) are installed. When we
try to move the database server to machine B, the ASP application threw an
exception when it tries to connect to the remote database:
Login failed for user 'XXX'. Reason: Not associated with a trusted SQL
server connection.
Both machine A and B do not belong to any domain (but are of the same
workgroup, same subnet.) We googled for it and found some websites suggest
that the SQL Server should be configured to use Windows _AND_ SQL
authentication. However this has no effect since it is already the default
of SQL Server 7.0. Some websites also suggest to use several combinations of
system user account and SQL server user accounts but it didn't solve the
problem either.
Finally, we seem to have found a workable solution. We changed the anonymous
user proxy account (previously IUSR_XXX) in IIS to a sytem user who is in
the local Administrators group and the ASP application works! I know that's
likely not the right way to solve the problem as it would make everyone to
use the Administrators role to execute the ASP application.
So my question is, how should we configure the servers so that the IIS (with
IUSR_XXX role) can talk with the remote SQL Server (with pure
username/password authentication)? How can we completely disable Windows
authentication and access controls?
Thank you very much,
KennethThis article has your solution.
253500 PRB: "Client Unable to Establish Connection" Error Message When
http://support.microsoft.com/?id=253500
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.
Showing posts with label webserver. Show all posts
Showing posts with label webserver. Show all posts
Wednesday, March 7, 2012
IIS and SQL 2005
I need to have my web server IIS 6 access our database SQL2005. Our web
server holds other web sites so I would like to leave it in the DMZ and the
SQL in the lan. From what I have heard this is not the best method. Has
anyone done this. Is there a better way.
ThanksHello royst,
> I need to have my web server IIS 6 access our database SQL2005. Our
> web server holds other web sites so I would like to leave it in the
> DMZ and the SQL in the lan. From what I have heard this is not the
> best method. Has anyone done this. Is there a better way.
Sometimes is design is about the only secure method making it work. The prob
lem
with it is that its lower perf that having the SQL Server in DMZ because
of need to connect back through a firewall. You may also have to use standar
d
logins, but as long as you're taking reasonable steps to secure your DMZ
to LAN connection, that's probably an acceptable risk.
Thanks!
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Thanks Kent
The performance is not an issue. Security on the other hand is. I have
reservations on opening up SQL ports on my firewall. Just tring to find a
more secure way to do this with IIS in the DMZ and SQL in the local Lan.
"Kent Tegels" wrote:
> Hello royst,
>
> Sometimes is design is about the only secure method making it work. The pr
oblem
> with it is that its lower perf that having the SQL Server in DMZ because
> of need to connect back through a firewall. You may also have to use stand
ard
> logins, but as long as you're taking reasonable steps to secure your DMZ
> to LAN connection, that's probably an acceptable risk.
> Thanks!
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
>|||Hello royst,
If you have a decent firewall, you should be able to restrict by address
who can initiate a connection on port 1433. You could also require TLS or
SSL encryption on the connection for good measure with with performance impl
ications.
The alternative would be do some form of replication, but that leaves you
with a port (or set of them) open at some point.
Good luck,
kt
server holds other web sites so I would like to leave it in the DMZ and the
SQL in the lan. From what I have heard this is not the best method. Has
anyone done this. Is there a better way.
ThanksHello royst,
> I need to have my web server IIS 6 access our database SQL2005. Our
> web server holds other web sites so I would like to leave it in the
> DMZ and the SQL in the lan. From what I have heard this is not the
> best method. Has anyone done this. Is there a better way.
Sometimes is design is about the only secure method making it work. The prob
lem
with it is that its lower perf that having the SQL Server in DMZ because
of need to connect back through a firewall. You may also have to use standar
d
logins, but as long as you're taking reasonable steps to secure your DMZ
to LAN connection, that's probably an acceptable risk.
Thanks!
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Thanks Kent
The performance is not an issue. Security on the other hand is. I have
reservations on opening up SQL ports on my firewall. Just tring to find a
more secure way to do this with IIS in the DMZ and SQL in the local Lan.
"Kent Tegels" wrote:
> Hello royst,
>
> Sometimes is design is about the only secure method making it work. The pr
oblem
> with it is that its lower perf that having the SQL Server in DMZ because
> of need to connect back through a firewall. You may also have to use stand
ard
> logins, but as long as you're taking reasonable steps to secure your DMZ
> to LAN connection, that's probably an acceptable risk.
> Thanks!
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
>|||Hello royst,
If you have a decent firewall, you should be able to restrict by address
who can initiate a connection on port 1433. You could also require TLS or
SSL encryption on the connection for good measure with with performance impl
ications.
The alternative would be do some form of replication, but that leaves you
with a port (or set of them) open at some point.
Good luck,
kt
Subscribe to:
Posts (Atom)