odbc and database security

[azmirnordin]

Hi all guru's

Is there any way that I can setup username and password to allow only certain user to access my access 2007 database? Now without username and password access 2007 database can be access through External Data ->More->odbc Database. I need to add some sort of security features.I really appreciate anybody to comment, since i a newbie in access

regards,
azmirnordin

 

[Trevor G]

Create a table to hold the employee information including password and then you can create a form to let the employee pick there name and then enter there password which you can check against the table if correct let them in if not then produce a friendly message stating password or username incorrect and if they don't have permission they should then contact you or the adminsitrator to gain access. Then add a macro to open the form and save the macro as autoexec then when the database starts it shows the form.

If you need a sample let me know.

 

[Pat Hartman]

Access databases cann't be secured. They can always be broken into if you know how. The best solution for Jet/ACE is network security. The BE needs to be on a network share with limited accessibility. If the data is truly sensitive, move it to SQL Server which is more secure.

 

[Banana]

Just to clarify, because the title was "odbc and database security" and this appears to be for an Access backend, it's not really ODBC that's responsible for security. All it does is pass forward the authenication information and let the endpoint handle it. Furthermore, ODBC is only one way to connect; there's also OLEDB and DAO.

As Pat alluded to, the main weakness is not with what protocol you're using, but the fact that you have the data file available to you because Access is file-based database. It's analogous to putting data in a little safe and leaving the safe out on your front yard. You're trusting everyone to not take the safe in their car and drive away to some forest and take as much time as they want to crack the safe. Filesystem permissions prevents access from people who shouldn't be using the data at all but otherwise makes no distinction between people who can see all data and people who can see only some of data.

If you do realize you want to use a server-based solution, this may be of some help.

Best of luck!