Win32::ODBC & Encryption / SQL Server

[1DMF]

Not sure if this is the right forum, it's just I use PERL & Win32:ODBC to make the database connection, so here goes...

I have external web hosting, the PERL uses the Win32::ODBC module to connect to OUR SQL server which is in house, thus making the request to connect and the data transfer across the internet.

The question is, is this data transfer secure? , is the login request passing userid and password encrypted? and once connected is the transfer of data secure?

If not, how do I lock this down and secure the data transfer?

Can this be done simply with a switch to the Win32:ODBC module.

How might securing the connection affect the port to the SQL server, aren't secure requests handled by port 443? and SQL is on a different port.

Any help understanding how the request is made and connects and how to secure this process is very much appreciated.

Regards,
1DMF



"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you.

 

[PaulTEG]

I don't think the connection is encrypted by default, you'd have to check the documentation for that. That's not to say you can't encrypt it, or create a tunnel to talk to a process on the DB server and have it en/de/crypt at both ends.

A more reliable solution depending on how much data and how timely it needs to be would be to have scheduled dumps to a mysql datbase on the server, and send update requests back to the main server. Thus the mysql db if if gets tampered with (not likely) will be overwritten by the next import.

Haven't had to connect to a db server from a external webserver before, so I'm not entirely sure. Secure requests over https are handled by port 443, but you could implement your own port for process to process communication, it'd be another link in the chain though, and would be subject to the encryption overhead.

personally, where possible, and dependent on load, I'd be happier with the DB and webserver on the same machine or at least within the same network ... but that's just me ;-)

Paul
------------------------------------
Spend an hour a week on CPAN, helps cure all known programming ailments ;-)

 

[1DMF]

I know Paul, I wish we could but we don't have the resources or internet connection to host the site and thus PERL/IIS. We have a single SBS server with SQL.

We need ownership of the SQL data for FSA compliancy regulation, disaster recover, data protection... you know the score, plus the SQL is also our internal DB backend which obviously need to be inhouse.

Thus leaving me the problem, If we had mySQL or whatever at the webhost, we have no control, no guaranteed backups, no easy restore facilities and no communication with our in-house DB.

So with the help of Tek-Tips, i've managed to make it all seamlessly intergrate, with this webhost to remote linkup.

But this is leaving me with security issues.

I did originaly concider some sort of DTS that might keep the servers in Sync, but have been unable to work out understanding how to implement it and if it is at all possible.

The overhead of secure encrypted data transfer for my current solution, is a worry, as our internet connection is only 0.75mb upstream, and there are already times when the SQL server requests timeout, the added overhead of encryption/SSL could make things worse.

Some kind of secure DTS process might be the ideal solution.

Any pointers?

"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you.

 

[cdlvj]

Look in your ODBC panel, there is a check box for strong encryption.

If you do not have that, then search for a newer driver.

 

[1DMF]

ODBC panel? - Do you mean somewhere on the SQL server?



"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you.

 

[cdlvj]

No, would be on your client. Where you configue the ODBC stuff. It is like on the 3rd or 4th screen.

 

[1DMF]

i'm lost , I use WIN32::ODBC PERL module and a file DSN, I don't do any ODBC configuration

"In complete darkness we are all the same, only our knowledge and wisdom separates us, don't let your eyes deceive you.