[Progress Communities] [Progress OpenEdge ABL] Forum Post: RE: Database is allowing operations even for non-existing users

  • Thread starter Thread starter dbeavon
  • Start date Start date
Status
Not open for further replies.
D

dbeavon

Guest
I didn't see it come up, but the way we've secured access to the SQL-side of the OE database is by adding "-ServerType SQL" to the proserve when starting the broker. That way it disallows any remote ABL connections - which can be even more insecure than the SQL ones. On the SQL side of things, you must specify GRANT statements before the databasse will give access to data. Unlike SQL, any remote ABL clients are typically allowed full access to the data until it is explicitly denied. On the ABL connectivity side (if you ever end up needing it), the only reasonable way we've found to add security is with IP filtering on the port number. IP filtering is a function of the OS.

Continue reading...
 
Status
Not open for further replies.
Back
Top