Hi,

on my production box (V-Server w/Sql Server Express) I am using an sql server account (and a cleartext password in web.config) for sql connections. On my dev box, I found it more convenient to add "Network Service" as an owner of the DotNetNuke database.

If I did the same on the production server, then I could turn off sql server authentication mode. I am hesitating, because I think I read that it is not such a good idea to give "Network Service" access to your sql servers. ON the other hand the sql server on the production box is being used by the DNN database exclusively.

One disadvantage I see with turning off sql server authentification mode is that I am not sure how to connect to the production box with sql server management studio, since dev box and production box are not in the same domain (dev is Windows 7 and connecting via DSL to the Windows 2003 VServer hosted by a provider).

Can someone hint on the proper way to do this? TIA for any hints, Regards
Tim

From a security perspective, I highly recommend using integrated security for your production websites.  Each application pool can and should have a separate account with access locked down to just the database needed to service that application.  This helps isolates the websites and makes hacking into each one more difficult.

If you need remote db access then using SQL logins is still a possibility.  Just because the website is using integrated security does not mean you have to use integrated security as well.

Ultimately, being secure always requires more work to setup and maintain, however, if you care at all about not losing control of your website or your data, then you'll take reasonable security precautions which varies from website to website and business to business.  Obviously, the security around Amazon.com is much different than the security I employ on my local blog.  Regardless, there is a minimal level that should be assumed for any public facing website, and that includes not using cleartext passwords in web.config.