Explore the optimal NTFS permission settings for Access 2000/XP databases through experiments

We already know that ASP. NET uses ADO. NET to Access the database and can Access the Access database through the OleDb connection-one of our very common low-end databases. This article discusses several error prompts that may be seen in ASP. NET, from which you can see database files created by Access 2000 and Access XP. Different error prompts will appear when Access errors occur. Hope to help you. Another key point is to use this article to give you a new understanding of the NTFS permission settings for Access database files in ASP. NET.

(1) experiment process

For the sake of convenience, let's take an experiment: The application is/test, and the data inventory is stored in D: wwwrootestdatadb1.mdb, which we already know in ASP. NET accesses the database as an asp net virtual user. We need to grant this account specific NTFS permissions to Make ASP.. NET program runs normally.

To get the strictest NTFS permission settings, we will give the program the lowest NTFS permission at the beginning of the experiment:

A) D: grant the following permissions to aspnet in the wwwrootestdata Folder:

Reject allowed
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write □□

 

B) D: The wwwrootestdatadb1.mdb file itself grants the user ASPNET the following permissions:
√ Allow propagation of inherited permissions from parent to this object

 

1.1 For An aspx program that only contains the "SELECT" command, the above permission settings are not available during running, that is, the above permissions have met the operation of such programs.

1.2 For aspx programs that contain commands such as "UPDATE", "INSERT", and "UPDATE,

(A) If db1.mdb is a database created by Access 2000, the following error occurs:

A server error occurs in the "/test" application.
---------------------------------------
Microsoft Jet Database Engine cannot open file D: wwwrootestdata. It has been opened exclusively by another user or has no permission to view data.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: System. Data. OleDb. OleDbException: the Microsoft Jet Database Engine cannot open the file D: wwwrootestdata. It has been opened exclusively by another user or has no permission to view data.

(B) If db1.mdb is a database created by Access XP, the following error occurs:

A server error occurs in the "/test" application.
----------------------------------------------
The operation must use an updatable query.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: System. Data. OleDb. OleDbException: The operation must use an updatable query.

 

(C) Preliminary Analysis of the Cause: Because there are commands such as "UPDATE", "INSERT", and "UPDATE", the database file itself needs to be written, so the above permissions cannot meet this requirement, we need to further release the permissions.

We release some permissions,
A) D: The wwwrootestdata folder remains unchanged:

B) D: The wwwrootestdatadb1.mdb file itself grants the user ASPNET the following permissions: Allow denied
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

 

1.3 open the permission and continue the experiment,

(A) If db1.mdb is a database created by Access 2000, the following error occurs:

A server error occurs in the "/test" application.
------------------------------------------
Files cannot be locked.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: System. Data. OleDb. OleDbException: the file cannot be locked.

 

(B) If db1.mdb is a database created by Access XP, no error occurs.

 

(C) Preliminary Analysis of the Cause: We found that a *. ldb file with the same name will be generated in the directory where the Access database is opened, which is a lock mark of Access. In view of this, we guess that when the user ASPNET accesses the Access database, it also needs to generate a lock mark, and this directory does not allow it to write, so an error occurs. The reason why the database created by Access XP does not have this error is unknown.

We further open the permissions,
A) D: Give the user ASPNET the following permissions in the wwwrootestdata Folder: deny
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The wwwrootestdatadb1.mdb file itself grants the user ASPNET the following permissions:
√ Allow propagation of inherited permissions from parent to this object

1.4 continue the experiment and find that the error has been resolved. The above permission is the "minimum permission" we need to release ".

(A) If db1.mdb is a database created by Access 2000, we will find a small problem: generated *. ldb files will not be deleted by themselves. The files still exist after access, but this problem will not affect ASP.. NET.

(B) If db1.mdb is a database created by Access XP, the above similar problem does not occur.

(C) Preliminary Analysis of the Cause: We only gave ASPNET the permission to write folders and did not have the permission to modify them. Therefore, once a file is written, its content cannot be modified ,*. ldb cannot be deleted.

If you have to solve this problem, you can further release the permission:
A) D: Give the user ASPNET the following permissions in the wwwrootestdata Folder: deny
Full Control □□
Change √ □
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The wwwrootestdatadb1.mdb file itself grants the user ASPNET the following permissions:
√ Allow propagation of inherited permissions from parent to this object

1.5 is included in the experiment. In another case, we open and edit db1.mdb in Access and Access ASP. NET at the same time.

(A) If db1.mdb is a database created by Access 2000, we find that there is no problem.

(B) If db1.mdb is a database created by Access XP, the following error occurs:

The server error in the "/zhao" application.
------------------------------------------------
Cannot be used; the file is in use.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: System. Data. OleDb. OleDbException: unavailable; the file is in use.

(C) Preliminary Analysis of the cause: the Access database is a single-user single-threaded database. When we open and edit database files in Access, we actually open the database as the current Windows user (such as Administrator, ASP. by default, asp net virtual Users (affiliated to the Users group) are used. They are lower than the Administrator level and cannot "snatch" permissions with the Administrator. Therefore, a conflict error occurs. We do not need to discuss the situation where Access 2000 ignores this issue. It may be that Access 2000 does not consider so many factors.

1.6: Change the db1.mdb attribute to "read-only". Both Access 2000 and Access XP have the same error messages as those in Access 1.2.

(2) experiment conclusion

1. First, let's repeat the origin of the NTFS permission settings for Access database files:

In ASP. by default, NET accesses and operates databases as a virtual user called ASPNET, you can see this user in "Control Panel"-"Administrative Tools"-"Computer Management"-"local users and groups"-"users". The default value is:

Full name: ASP. NET computer account
The account used to run the ASP. NET auxiliary route (aspnet_wp.exe.
Affiliated to: Users Group.

Using a user in the Users group to perform file operations and database operations is much less risky than using an Administrators Group. This is also ASP. NET in terms of security.

Since such a user needs to access and operate the database file itself, we need to grant it certain NTFS permissions to allow its access. Obviously, if you do not have the NTFS permission, ASPNET will be unable to access and operate the database, and the errors shown in the above experiment will appear.

2. After the above experiment, we already know that the following NTFS permission settings can meet general requirements:

A) D: Give the user ASPNET the following permissions in the wwwrootestdata Folder: deny
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The wwwrootestdatadb1.mdb file itself grants the user ASPNET the following permissions:
√ Allow propagation of inherited permissions from parent to this object

At the same time, we also noticed that whether db1.mdb is a "read-only" file also affects asp net access.

3. The preceding permission settings can be set directly to the ASPNET user, the Users Group, or the Everyone group. Because ASPNET is affiliated to the Users group, you can set permissions for ASPNET through the user group.

4. set the NTFS permission in the "properties" dialog box-"security" tab after right-clicking a file or folder. Generally, you can give the Adminitrators group the "full control" permission, at the same time, do not easily tick in "deny". For the NTFS permission setting skills, consult the network administrator and network security experts for advice.

Note: partitions in FAT and FAT32 format