Re: Limiting SQL Access

[Carel Teijgeler <teygeler@xxxxxxx>]

rob@dekko.com wrote:

> It seems there is some confusion on the list as to how you define abuse.
> Some are interpreting abuse as accessing or modifying data that they should
> not be.  Some are interpreting it as running a large query that affected
> processor performance.  Your definition please?
>
> I am going under the assumption that it is data access/modifying that you
> are trying to control.
>
> Ideally you should control the access to data in the files themselves.  The
> normal way is to deny everyone and to use programs which adopt authority.
> Kinda puts a crimp in your style if you do any Client/Server programming.
> Requires you to be more creative.
>
> Failing this then you might want to consider changing the authority to the
> STRSQL command.  Someone mentioned that people can still update files using
> QMQRY objects (see STRQM or STRQMQRY).  The cool thing about STRQM is that
> you can limit which users can run which command.  For example if you want
> someone to be able to run SELECT but not UPDATE or DELETE you can.
>
> This is just the tip of the iceberg though, if you are not going to control
> access to the data itself.  Because then you have to lock down so many
> other things:  UPDDTA, WRKDBF, CPYF, CLRPFM, DLTF, exit points, and on and
> on and on...
>
> Rob Berendt
>

As extra point to that: triggers can recognize changes by query tools and DFU 
tools.
So if a database is done by a programme starting with "Q" then it is a system 
object and
should be cancelled.

Regards,

Carel Teijgeler.


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---