Re: Acessing data - security versus ease of use

Hi Daniel,

your post didn't appear on the news server I'm using for some reason, but I noticed it from this post. Maybe 9i databases offer some extra security, but I noticed that you mentioned that you never let anyone connect with ODBC so how does the version of oracle affect the answer? By the way, we are using oracle 9.2.0.4 on solaris 8, but how does this change the answer? If I was using oracle 8.1.7.4 on Windows 2000 would that change your solution? You mentioned that there are plenty of solutions, so it would be great if you could list just a few.

"Ed Stevens" <nospam_at_noway.nohow> wrote in message news:itsrsv8sd0p0bi9d4uiokgbe9ln2gshump_at_4ax.com...
| On Tue, 02 Dec 2003 21:07:13 -0800, Daniel Morgan
| <damorgan_at_x.washington.edu> wrote:
|
| >Snid wrote:
| >
| >> I was wondering how people allow clients to access the data from their
| >> databases?
| >>
| >> All of our machines are locked down with firewall rules, so that only a
few
| >> people are allowed through the firewall; however, this prevents people
| >> accessing the data with ODBC which means complex methods of replicating
data
| >> and allowing it to be accessed are used, ie dumping the data into
another
| >> database which is less secure.
| >>
| >> What sort of middle tier applications or gateways are people using?
| >>
| >> Are there any alternatives such as using some sort of ODBC connection
over
| >> https?
| >>
| >>
| >It would be remarkably valuable to know a few things first:
| >1. Verion and edition of Oracle.
| >2. Hardware platform and operating system.
| >3. What front-end tools are being used.
| >
| >But in general ... I never ... and I mean NEVER ... use ODBC to connect
| >to a database. There are plenty of solutions. Knowing more about what
| >you are doing would be a first step to making a recommendation.
|
| Daniel,
|
| I would be interested in some of the alternatives to ODBC. We have a
| growing base of people using MS-Access to develop their own reports
| against Oracle db's. We give them a common user-id that has read-only
| access, but I've never been comfortable with this, for a couple of
| reasons. First, I foresee the day when they will start demanding
| update capability. If that is granted, all data integrity goes out
| the window. Second, ODBC drivers seem particularly brittle -- very
| dependant on exact version, release, patch of both the OS (Windows)
| and the Oracle client.
Received on Wed Dec 03 2003 - 22:46:03 CST