Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
DavidChel
Constraint Violating Yak Guru
474 Posts |
 Posted - 2008-09-21 : 17:16:34
|
| The ERP software that I deal with uses the SA login. The users log into the software with their own logins, but all of the communication between the software and the database is done with SA. I think this is bad for the following reasons: 1. Tracking database changes by user is difficult to impossible. 2. By default, SA has all rights to all databases on the entire server. Using this is inherently insecure.3. Changing the SA password is a bit more complicated in this situation and you should do this periodically. Have I made any assumptions that weren't correct? Are there more reasons why this is a bad idea that you folks can think of? |
|
|
DavidChel
Constraint Violating Yak Guru
474 Posts |
Posted - 2008-09-22 : 12:12:33
|
Anybody?  |
 |
|
|
DavidChel
Constraint Violating Yak Guru
474 Posts |
Posted - 2008-09-23 : 12:57:46
|
| Is this a stupid question or something? |
|
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
|
|
DavidChel
Constraint Violating Yak Guru
474 Posts |
Posted - 2008-09-23 : 14:11:27
|
| There is no other way to use the software besides using the SA. The reason I bring up the subject here is because I have no idea if most database programs operate this way or is this unusual? If it is unusual, am I right that this is a bad idea for the reasons I listed? |
|
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2008-09-23 : 14:28:42
|
and yes it is very usual....  _______________________________________________Causing trouble since 1980Blog: http://weblogs.sqlteam.com/mladenpSpeed up SSMS development: www.ssmstoolspack.com <- version 1.0 out! |
|
|
|
|
|
|
ERP System uses SA Login