Jim Hewson
jm.hwsn at gmail.com
Mon Apr 26 09:30:11 CDT 2010
Lambert, For A2007 you're not too far off though. In a pure (no other versions) A2007 scenario I would probably do the same. Except, I would hide the subdirectory using the "$" from the typical UNC path and encrypt and password protect the backend. Prior to that, I would create a couple of dummy tables and hide (change table attribute to hidden) then ensure the tables are not showing in the navigation pane in the front end. My explanation: If the directory is hidden, most users wouldn't be able to find the directory where the BE resides. The BE is easily encrypted with a password. Access 2007 uses 40 bit encryption to encrypt a file. But that can be pushed to 128 if really needed. If someone attempts to link or import any tables then they are required to supply the password before they can even see anything. The reason I would create dummy tables and hide them is that if someone wanted to look at the tables linked in the front end they could do that. But if the tables are hidden they won't know they are there. With a few lines of XML code in a hidden system table, ALL ribbons and commands are hidden and cannot be used except to Exit Access. Of course, it goes without saying... disable the By Pass key. Jim -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com] On Behalf Of Heenan, Lambert Sent: Monday, April 26, 2010 8:48 AM To: Access Developers discussion and problem solving Subject: Re: [AccessD] Database Needs Password Protection No. Nobody will be able to open the folder in which the backends reside (except for the admins). So they cannot open them directly at all.Not being able to open the folder, they cannot discover the name of the files in there, so cannot link to them from any other application. Your task will be to restrict them from getting access to the databse window where they will see the tables and queries, and to prevent them from running any code they may craft themselves. Standard Access stuff. As long as nobody in the user pool knows the names of the backend files they will not be able to open them in any access app. They may put together themselves. They will only have access vie the approved applications. # HOLD THE PRESSES!!! #####*($*#*$#*$#*$#*$#*$*#*$*#*$*#*$*# ###################################### Dang!!! ########### Just found the elephant sized hole in my suggestion. All they need to do is import the table links from an approved application front end and bingo... they have full access to the tables. Back to the drawing board. ############################################################# Lambert -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com] On Behalf Of Rocky Smolin Sent: Monday, April 26, 2010 9:25 AM To: 'Access Developers discussion and problem solving' Subject: Re: [AccessD] Database Needs Password Protection Lambert: His requirement is that anyone who tries to modify the back end directly will be unable to do so but will still be able to modify the data through the front end. It looks like with your approach a member of the group will be able to open the back end directly and be able to modify the data in the tables. True? Rocky -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com] On Behalf Of Heenan, Lambert Sent: Monday, April 26, 2010 6:18 AM To: Access Developers discussion and problem solving Subject: Re: [AccessD] Database Needs Password Protection Rocky, What kind of restrictions do they want? If they simply want to prevent users from getting into the folder that holds the backend files then you can do all of that with Windows security (NT/2K/XP/Vista/7)and not a line of code needed. You'll need cooperation from the client's network people but... First thing you want is a windows user group into which all the users are added. This makes it much simpler when applying permissions to folders. So. First make a folder on the server say 'Databases' Next create a subfolder called 'Backends'. Third create a subfolder in Backends which you can call 'Data'. Now modify the permissions on 'Databases' granting the user group modify permissions and apply the permissions to the folder and all sub-folders. Also make sure that an administrator's ID and or the Database administrator's ID is granted full control of the folder tree. Now you need to modify the permissions on the 'Backends' folder. Open the properties sheet for the folder and select the 'Security' tab. Click the 'Advanced' button. Select the user group in the permissions listing, and click 'Edit'. In the resulting dialog box clear the check boxes for 'Traverse Folder / Execute File', 'List Folder /Read Data' and (most importantly) 'Delete Subfolders and Files'. Click OK and OK. The end result is that the user in the user group have modify permissions to the 'Data' folder , and that is where all the backends would reside, in their own sub-folders if desired. However, the users will only be able to look inside the folder 'Databases' where they will see that there is a folder called 'Data' inside it, but they will not be able to browse into 'Data' nor delete it. Is that sufficiently restricted access? HTH Lambert -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com] On Behalf Of Rocky Smolin Sent: Sunday, April 25, 2010 3:28 PM To: 'Access Developers discussion and problem solving' Subject: [AccessD] Database Needs Password Protection Dear List: In my manufacturing software users log in with a password that gives them 1) read only, 2) read write, 3) administrator access. But the back end is wide open. So far this has not been a problem. Everywhere the system is installed people 'play by the rules'. Now comes a client who wants access to the back end restricted. So I'm trying to think of way to do that with the least disruption to the system which BTW supports multiple back ends - the user can open a different back end through an 'Open a Database' utility. In the code, of course, I'd have to change all occurrence of set db = CurrentDb to Set db = DBEngine.OpenDatabase(gstrDB, False, False, ";pwd=" & gstrPWD) where the password would be in gstrPWD. Then I would have to add a utility accessible only by someone with admin rights, to 1) set, 2) remove, and 3) change the password on the currently linked back end. Don't know what that code looks like but I suppose I can figure it out. Question is - is this the shortest distance between the two points? Or is there another approach which would be faster/better/easier? MTIA Rocky Smolin Beach Access Software 858-259-4334 www.e-z-mrp.com <http://www.e-z-mrp.com/> www.bchacc.com <http://www.bchacc.com/> -- AccessD mailing list AccessD at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/accessd Website: http://www.databaseadvisors.com -- AccessD mailing list AccessD at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/accessd Website: http://www.databaseadvisors.com -- AccessD mailing list AccessD at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/accessd Website: http://www.databaseadvisors.com