how to protect mdb

[Danny]

Hello

how can you protect the .mdb that an asp page modifies?
This must be open to all for modifications right?
But how can it be hidden so people can't just download it if they guess the
path?

Thanks

 

[Steven Burn]

Simple..... stick it outside of the website root.

For example, if your setup is along the lines of;

\htdocs\your_website
\logs
\private

Place the MDB file inside the Private folder. This is out of reach of
internet users, and is still accessible to your applications.

When placing the file outside of the root, you will need to modifiy the path
to something along the lines of;

TheDB = "..\..\Private\TheDB.mdb"

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[Aaron [SQL Server MVP]]

http://www.aspfaq.com/2454

 

[Evertjan.]

Curt_C [MVP] wrote on 01 jun 2004 in
microsoft.public.inetserver.asp.general:

simply move it outside the WWW path

Or make an unguessable directory structure

/dsklfi958340/958kndlzzzz/my.mdb

[and prohibit directory browsing]

 

[Steven Burn]

Nah, even thats viewable (can't remember their names off hand but, there's a
few programs that allow one to connect directly to a website, and
view/download the file's and folders inside the root).

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Curt_C [MVP] wrote on 01 jun 2004 in
microsoft.public.inetserver.asp.general:

simply move it outside the WWW path

Or make an unguessable directory structure

/dsklfi958340/958kndlzzzz/my.mdb

[and prohibit directory browsing]

 

[Egbert Nierop \(MVP for IIS\)]

Nah, even thats viewable (can't remember their names off hand but, there's a
few programs that allow one to connect directly to a website, and
view/download the file's and folders inside the root).

Nope,

You mean directory browsing or webdav. Webdav is not so easy by default. You
must enforce non-anonymous access for webdav to be possible.

 

[Steven Burn]

Not quite no.....

The following isn't the program I was referring to but, it's along the same
lines.

http://www.brothersoft.com/Internet_Browsers_Browse_Anywhere_18303.html

I'll see if I can find the freeware one again........

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[Danny]

Thanks everybody
i checked and I do not have access to anything other than web folder. I
checked with the ftp program and I cannot go back one directory. I guess I
should talk to web hosting company on that site?

Thanks

 

[Steven Burn]

EEK!..... they've not even given a private folder?.... (no offence but, I'd
be having serious talks with them <g>)

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[Aaron [SQL Server MVP]]

A "private" folder is still only as secure as the file system and/or the FTP
credentials.

IMHO, Access is the wrong tool if a primary objective is security.

 

[Danny]

Thanks again.
I just found out they keep everything in the root of the website.
I am using asp to access this database.
Is there anything I can do? or is making the path very obscure good enough?

thanks again