Hi Slaven,

During setup and upgrade you need a user with permission to create tables and such so at that time you generally should use a user with dbo permission.

However, you can harden the security of a mojoportal installation on MS SQL after installation. Since the MS SQL version uses stored procedures for everything, in my opinion the best security can be achieved by creating a new sql user and grant only exec permission for all the stored procs. Now this user can't directly access any tables and cannot do any ad hoc queries. There will be some maintenance because after upgrades you will have to give the user exec permission on any new procs in each new version.

I don't recommend using system accounts like NETWORK SERVICE for the db connection string. If you want to use a windows user, create a new user just for this purpose with minimal permission. Myself I generally don't use windows authentication with MS SQL, I configure it for mixed mode and use sql users and sql authentication.

Best,

Joe

You are right, I mean there is nothing really bad about using that account but I prefer not to use accounts that are widely known, built in accounts are well known. So for me its the same as using the Administrator account, better to create your own and disable the well known one. I'm not saying to disable the NETWORK SERVICES account. I'm just saying that hackers know about built in accounts and therefore they tend to be used as attack vectors. You can obscure things a little further by using custom accounts. Its minor point, but in security every little bit can help.

Best,

Joe