Hello all,

We are building a DNN three stage environment: DEV - STAGE - PROD.

Background: DNN Admin with little .NET programming
Server 2008
SQL 2008
DNN 5.4.2

(I have searched all over and may have missed a thread for both of these questions/concerns so point me to the correct direction or answer directly)

Concern 1: Our SQL DBA's concern is security with a developer (a contractor, myself and future workers) knowing the UID/PID of the Production DNN SQL Server (stored in web.config of course). Typically in other environments, the DBA would set up a DSN on the production server with UID/PID so the developer would not have to know them, decreasing their liability.

Question 1: HOW do you set up a the Connection String in web.config to connect to SQL via a DSN?
It may be simple but I failed to find it being set up other than using the SQL client object.

Concern 2: The next concern is allowing the HOST in Production access to the SQL module. Here his main concern is if it is running as DBO then a less-than-knowledgable Site Host (contractor with access) could really jack up the Production SQL Server.

Question 2: WHAT is the best way of eliminating the SQL module/capabilities from the DNN Production instance?
Delete the page? Manually delete the module?
The module will still be available if the page is deleted. Understood. Is there a clean way to uninstall the capability? the Module?

Any advice is welcomed. If I need to explain further, please let me know.

Thanks!

Mike

Sebastian,

Thanks for the reply. In response to your answers:

Q1: To help me understand and clarify your statement, I need to:

• check the integrated security check box on install
• make sure that there is a Windows Account (AD account) that has access to the database VERSUS a SQL-based account... i.e. a system account that the DBA is accountable for which "hides" the password from us contract developers

Q2: Other than deleting the Host::SQL page to give a "sense" of security, the Superuser/Host account can esentially install another module that does the same thing as you said... basically requiring a personnel policy for our DNN webmasters to BE CAREFUL and ONLY use the Host account when needed (i.e. install Host-level Extensions, portal creation, lists, DNN update).

Thanks again for the quick and helpful response!

Mike