Looking for input on SQL 2005 and IIS Security

I am just looking for feedback and maybe pointers for research regarding securing SQL 2005 for IIS access. I am currently working on a project for building a new retail website and our sysadm guys have some concerns regarding exposing our SQL box to the DMZ via direct connections to the IIS box. Now we have not completely come to a conclusion of saying that it is not possible, but we are very concerned due to recent credit card and customer data problems in the industry.

So far we have mainly talked about just exposing web services(limiting the exposure of data that can be retrieved) on an internal IIS box that would be called allowed to be accessed from only the IIS box in the DMZ using User Accounts and Client SSL Certs. What I am most concerned about is the performance of this design. I would like to try and provide a connection to the SQL box directly for the devs, but I am not sure what the best practice would be for securing this connection through the firewall and also monitoring it in case our DMZ IIS box gets owned.

Any input or direction to resources would be much appreciated. I have read quite a few papers so far and just want to get feedback on architectures and designs.

Thanks in advance.

Options include: using IPSEC (or SSL) to control the connection between the IIS box and SQL Server (and Developers). Only 'approved' IP addresses would be allowed to connect to SQL Server. That protects SQL Server from being directly attacked, but not from attack from the IIS box.

Using IIS's capability to use Application Pools, you can further restrict access to SQL Server through the Application.

Here are some resources that might be useful:

Web Applications -Connect to SQL Server
Configuring an ASP.NET 2.0 Application to Work with Microsoft SQL Server 2000 or SQL Server 2005
http://imar.spaanjaars.com/QuickDocId.aspx?quickdoc=395
How To: Create a Service Account for an ASP.NET 2.0 Application
http://msdn2.microsoft.com/en-us/library/ms998297.aspx
How To: Connect to SQL Server Using Windows Authentication in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998300.aspx

Looking for how to for SQLexpress

I recently installed SQL express on my winXP machine at home... Installed
and configured IIS as requested. I have created a simple table for testing
but cannot establish a DSN connection using either SQL or SQL Native driver
It mentioned something about allowing remote connections, but that feature
is turned on.. so not sure what else i need to configure to allow me to
connect so i can start testing some things out..
any sites or even books i can take a look at to complete this would be
great.Hi Daniel
"Daniel" wrote:

> I recently installed SQL express on my winXP machine at home... Installed
> and configured IIS as requested. I have created a simple table for testing
> but cannot establish a DSN connection using either SQL or SQL Native drive
r
> It mentioned something about allowing remote connections, but that feature
> is turned on.. so not sure what else i need to configure to allow me to
> connect so i can start testing some things out..
> any sites or even books i can take a look at to complete this would be
> great.
>
A remote connection should only be needed if you are trying to access your
SQL Express instance from another machine. It can be changed by using the th
e
Surface Area Configuration Tool SQLSAC.exe see previous post
http://tinyurl.com/23dum6 for links on this.
John|||I figured as much... when i installed it i took all the defaults and didnt
change anything.. but i will try this later tonight...
thanks for the reply.
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:75A3F905-C157-4283-A407-3DA7BA72A7D7@.microsoft.com...
> Hi Daniel
> "Daniel" wrote:
>
> A remote connection should only be needed if you are trying to access your
> SQL Express instance from another machine. It can be changed by using the
> the
> Surface Area Configuration Tool SQLSAC.exe see previous post
> http://tinyurl.com/23dum6 for links on this.
> John

Looking for how to for SQLexpress

I recently installed SQL express on my winXP machine at home... Installed
and configured IIS as requested. I have created a simple table for testing
but cannot establish a DSN connection using either SQL or SQL Native driver
It mentioned something about allowing remote connections, but that feature
is turned on.. so not sure what else i need to configure to allow me to
connect so i can start testing some things out..
any sites or even books i can take a look at to complete this would be
great.Hi Daniel
"Daniel" wrote:
> I recently installed SQL express on my winXP machine at home... Installed
> and configured IIS as requested. I have created a simple table for testing
> but cannot establish a DSN connection using either SQL or SQL Native driver
> It mentioned something about allowing remote connections, but that feature
> is turned on.. so not sure what else i need to configure to allow me to
> connect so i can start testing some things out..
> any sites or even books i can take a look at to complete this would be
> great.
>
A remote connection should only be needed if you are trying to access your
SQL Express instance from another machine. It can be changed by using the the
Surface Area Configuration Tool SQLSAC.exe see previous post
http://tinyurl.com/23dum6 for links on this.
John|||I figured as much... when i installed it i took all the defaults and didnt
change anything.. but i will try this later tonight...
thanks for the reply.
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:75A3F905-C157-4283-A407-3DA7BA72A7D7@.microsoft.com...
> Hi Daniel
> "Daniel" wrote:
>> I recently installed SQL express on my winXP machine at home... Installed
>> and configured IIS as requested. I have created a simple table for
>> testing
>> but cannot establish a DSN connection using either SQL or SQL Native
>> driver
>> It mentioned something about allowing remote connections, but that
>> feature
>> is turned on.. so not sure what else i need to configure to allow me to
>> connect so i can start testing some things out..
>> any sites or even books i can take a look at to complete this would be
>> great.
> A remote connection should only be needed if you are trying to access your
> SQL Express instance from another machine. It can be changed by using the
> the
> Surface Area Configuration Tool SQLSAC.exe see previous post
> http://tinyurl.com/23dum6 for links on this.
> John

Looking for how to for SQLexpress

I recently installed SQL express on my winXP machine at home... Installed
and configured IIS as requested. I have created a simple table for testing
but cannot establish a DSN connection using either SQL or SQL Native driver
It mentioned something about allowing remote connections, but that feature
is turned on.. so not sure what else i need to configure to allow me to
connect so i can start testing some things out..
any sites or even books i can take a look at to complete this would be
great.
Hi Daniel
"Daniel" wrote:

> I recently installed SQL express on my winXP machine at home... Installed
> and configured IIS as requested. I have created a simple table for testing
> but cannot establish a DSN connection using either SQL or SQL Native driver
> It mentioned something about allowing remote connections, but that feature
> is turned on.. so not sure what else i need to configure to allow me to
> connect so i can start testing some things out..
> any sites or even books i can take a look at to complete this would be
> great.
>
A remote connection should only be needed if you are trying to access your
SQL Express instance from another machine. It can be changed by using the the
Surface Area Configuration Tool SQLSAC.exe see previous post
http://tinyurl.com/23dum6 for links on this.
John
|||I figured as much... when i installed it i took all the defaults and didnt
change anything.. but i will try this later tonight...
thanks for the reply.
"John Bell" <jbellnewsposts@.hotmail.com> wrote in message
news:75A3F905-C157-4283-A407-3DA7BA72A7D7@.microsoft.com...
> Hi Daniel
> "Daniel" wrote:
> A remote connection should only be needed if you are trying to access your
> SQL Express instance from another machine. It can be changed by using the
> the
> Surface Area Configuration Tool SQLSAC.exe see previous post
> http://tinyurl.com/23dum6 for links on this.
> John