Restricting Network Access for applications

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I built a Database application using .NET 2.0 that used Access as its DB
backend for a library. Initially, the application was meant to support only
routine tasks of the library staff, and was not available to the public.
However, it has
been so successful that the library has decided to allow people to use it for
searching the library books.

Although security mechanisms were built into the application right from
scratch, but the file-serving nature of Access poses a problem. Due to its
file serving nature, an Access database needs to be available in a shared
network folder, for allowing clients to access it.
And here's the catch. A mischevious person can use Explorer etc. to directly
access the database. Although I can add a $ to the network name of the shared
folder to prevent it from being shown in explorer, but that doenot prevent
one to enter the path directly, in case he comes to know about it somehow.

Now, with what I know of Windows & .NET security mechanisms, I have found
one way to prevent this. I can create a Guest account on clients, & use
gpedit to deny it all Network permissions accept for .NET applications.
Next, I can configure .NET to deny Network access to all but my application.

Will this work in restricting Network access from clients to just my
application? If yes, how can I accompolish these tasks (the Windows part, I
can tweak .NET security using caspol.exe)? Is there a better solution?

Someone told me that appliation based security is not available with
Windows. I would atleast like to restrict explorer's access to Network
completely, as that's the most common interface to Network for users. If
that's also not possible, complete explorer deny on clients can also be an
option. In addition, the Guest account can be made to have readonly access to
the local disk also, thus denying them ability to install any other
application to access the Network.
 
Perhaps the simplest aproach would be to ensure the database is held open for
record-based writing by at least one computer at all times (could be the
server) - if this is so then Explorer cannot delete it.

The better approach would be to use TCP/IP based ODBC instead of a file
share. In this case a connection is made via an IP Port, and a logon and
password are supplied by the client to achieve this. (not the same as the
user's logon)

You could look at MySQL and see if it meets your needs - Access can still be
used as a frontend.
 
Anteaus said:
Perhaps the simplest aproach would be to ensure the database is held open
for
record-based writing by at least one computer at all times (could be the
server) - if this is so then Explorer cannot delete it.

The better approach would be to use TCP/IP based ODBC instead of a file
share. In this case a connection is made via an IP Port, and a logon and
password are supplied by the client to achieve this. (not the same as the
user's logon)

You could look at MySQL and see if it meets your needs - Access can still
be
used as a frontend.
Click to expand...


Who are you replying to?
Please QUOTE the post you are replying to.


http://www.netmeister.org/news/learn2quote.html

Thank you.
 
But a user can directly access & modify data. Moreover, this would not be
ann ideal approach. There's other data also on the server, which is
accessible to staff systems, but should not be so for user systems.
This would require too many changes, for which I dont have time & resources.
So, I am really looking for a solution within my constraints provided above.
 
Gordon:

1. Go get a life. Get a decent newsreader.
2. If you don't have a constructive response to the question, then stop
trolling.

Rahul:

I would suggest holding the file permanently open as the simplest approach.
Just beware in case it prevents backups though.
 
Well, I dont want to sound irritating, but it would really help if you can
tell me how to set the desired settings for sandboxing the whole system,
like removing explorer, deny access to the cmd etc.
 
Anteaus said:
Gordon:

1. Go get a life. Get a decent newsreader.
Click to expand...

BWAHAHAHAHA! Pot kettle and black - at least I AM using a newsreader, not
like you. And so do the majority of regulars here, which is why you need to
QUOTE the post you are replying to
2. If you don't have a constructive response to the question, then stop
trolling.
Click to expand...

Umm making you aware of Usenet usage and etiquette is NOT "trolling".
 
Back
Top