SSRS Security - sql-server

Scenarion:
I am having a web application which is going to use SqlServerReport(SSRS) sitting on ReportingServer which is on my DatabaseServer.
There is a firewall between webapplication & SqlserverReport server.
Now how safe is it to use reports directly from webserver (ie accessing something there on database server.)
We use a appserver to interact with the database data.
All basic calls are
UI ==> AppServer ==> DatabaseServer (general cases) :) happy
UI ==> DatabaseServerReports (to access Sqlserver reports) :(
So my concern is how safe is to access reports directly from Databaseservers.

Yo need to open the ports 80(http)/443(https) in the firewall to using the SSRS server from the AppServer.
Please, contact your Network Admin.

Our security folks made us install IIS on a separate partition.

Why not use your app to display the reports? With ASP.NET you can use a report viewer control to display the report so the user has no idea where the report is coming from except that it is within the application.

How safe depends on where the user is located. SQL Server Reporting Services was not intended to be opened up to the Internet, for instance. Neither was the SQL Server database engine, for that matter. You said there's a firewall between the web server and the SQL Server, but that's not an unusual configuration in internal networks nowadays.
The concern that might come up is one from the performance side, more than any other. By viewing the reports using SSRS, the report rendering will occur on the same server as your database engine. If the hardware isn't enough for both roles, you'll see performance issues.

Related

Azure availability set: IIS + SQL Server

Can someone please explain me what I need to do in order to make my websites available all the time using Microsoft azure.
At the moment I have just one dedicated server with IIS (running 7 websites) and SQL Server - all on one machine. Beside this I use Redis-lab as cloud service for hosting Redis cache.
I'm more or less happy how this works, but in case that something happens with server, or I need to restart it of course my website goes down which is not good of course.
So in order to make mitigate some of risks what exactly I need to do?
Am I correct in flowing thinking?
Option 1 - I need one more machine in an availability set with load balancer. This solution is not great as one server will still have an instance of SQL Server running = if that server goes down, websites on the second server will not work as the database is down
Option 2 - I need 3 more servers. 2 for IIS in a load balanced environment and 2 for SQL Server - which is super expensive solution.
Option 3 - 2 more servers. Where existing server and the new one will be for IIS (load balanced) + 3rd server with database. The database server will be write only. Both IIS severs will have an instance of ms SQL running in readonly mode => content from database server will be replicated to their databases. In this scenario if SQL Server goes down websites will still work as they will pull data from their own read only databases
Are there any other options?
Thanks
Regarding other options have you considered the option of moving the databases to Azure SQL which would give you redundancy out of the box? Similarly if you can move the websites to Azure App Service you can get the same for the sites.
Yes, you definitely need the availability set for your deployment. Please, take a look at Azure availability checklist written by Microsoft.
I would propose you to migrate your web apps to the Azure Web Apps + set up the SQL Server deployment according to the availability best practices. Migrating them to the web apps as a service will eliminate some administrative tasks and the problem of placing all of the eggs in the same basket. You can place them to the one Web Apps Pricing Plan and change that plan when needed, for example, from more powerful resources to least powerful (or from the paid one to the free one for all of your sites).
If SQL Azure is not a solution for you, and (from my point of view) the data source is more critical than frontent/.../, it is highly recommended to deploy SQL Sever according to the tutorials provided above.

Can you use SQL Server Reporting Services, SSRS 2008, to host an intranet site?

The project I'm on has a single server running both the SQL Server 2008 R2 database and the SSRS Reporting Services. Can I utilize SSRS to host a simple intranet site that would allow users to modify reference table data via a web app that I created?
I know SSRS is no longer tied directly to IIS. Is it possible to use SSRS's hosting facilities or will I be forced to install IIS?
I have read articles on how to utilize report parameters to do simple CRUD operations (http://www.sqlservergeeks.com/articles/sql-server-bi/26/using-sql-server-reporting-services-to-manage-data), but I'd prefer another solution, because at some point the data entry piece will be used to do more than manage lookup table data.
Any suggestions? Thanks!
Can I utilize SSRS to host a simple intranet site that would allow users to modify reference table data via a web app that I created?
Yes you could do that. From the different elements in a SSRS report you can link to web pages, so the report could link to your web app, then have the web app link back to reports.
Also, one report could link to another report, and you could accomplish an intranet with a dashboard page that links off to dozens of other reports.
I know SSRS is no longer tied directly to IIS. Is it possible to use SSRS's hosting facilities or will I be forced to install IIS?
In order to just run reports you would need an install of IIS, but in order to run other web applications, you will need a web server, and IIS will do the job.
As far as the data entry goes, you are probably best off using your web application rather than trying to implement data entry in the report. Technically you can do data entry using parameters on the reports, but it is a very ugly solution.
Still using Sharepoint with SSRS might give you want you want. Another option would be to use OneNote for some of the intranet pages, and put the OneNote files on a shared network location. You will still need your web app to enter data.
I hope this answers you question.

App fabric without SQL Server whatsoever

I got VPS with limited memory and my WCF service is hosted using AppFabric.
Since memory is limited and I am not using SQL server for anything other than AppFabric prerequisite im thinking about uninstalling SQL Server. (instance can eat up to 200mb memory at times). I am not using any DB related features of AppFabric like dashboard or caching. I like IIS extensions and simplicity for WCF service manipulations however, and I am thinking those do not require Sql Server actually.
I am unable to just try it out so wonder if someone has such experience, or can predict result of uninstalling SQL server on appfabric behaviour.
Instead of uninstalling SQL Server you could just stop the SQL Server process. Set the process to manual startup.
That way if you need SQL Server in the future you can just start the process.
As #Shiraz Bhajiji illudes to if you are using SQLServer as the configuration store, you will need to reconfigure it to use file based configuration instead, it sounds like you are only using a single AppFabric instance, but if you are or needed to use multiple instances the config file would need to be accessible to all instances.
Again it isn't necessarily relevant to you, but if you have multiple app fabric instances, the sql server configuration option is a much more robust approach. With the file based approach, if you configure things incorrectly one app fabric node going down can take down the entire cluster. The SQLServer approach does represent a single point of failure however, if you are using clustering etc you can easily mitigate this. Again I appreciate I'm getting a little off topic here.

Hosting an Access DB

So I'm inexperienced in hosting DB's and I've always had the luxury of someone else getting the db setup.
I was going to help a friend out with getting a webpage setup, I've got experience in Asp.Net MVC so I'm going with that. They want to setup a search page to query a db and display the results. My question I have is in getting the DB setup and hosted. They currently just have the Access DB on a local computer. There is basically only one table that would need to be queried for the search.
What is the best approach to getting this table/db accessible? They would like to keep the main copy of the db on the local machine, so copying the entire db over to the hosted site would be time consuming, could the lone table needed be solely copied to the host? Should I try to convince them to make changes on the hosted db and just make copies of that for their local machines? Any suggestions are welcome, Again I'm a total noob when it comes to hosting databases.
Thanks
Added: They are using a MS Access 2000, and the page will have access restrictions. Thanks for the responses.
How about SQL Server Express? I think you can do a remote connect from Access and just push the data over from Access.
I wouldn't use Access on a web server in any case.
I would strongly recommend against access from web work, its just not designed for it and given that SQL server express is free there is no reason not to give it a go.
You can migrate the data over by using the SQL server upsizing wizard, here is a link for help on using that feature
http://support.microsoft.com/kb/237980
It depends on what you mean by web work? Access 2010 can build scalable browser neutral web applications. They can scale to 1000's to users. In fact, you can even park the web sites on Microsoft's new cloud hosting options, and scale out to as many users as you need.
Here is a video of an application I wrote in access 2010. Note how at the half way I run the same application including the Access forms in a standard web browser. This application was built 100% inside of the Access client. The end result needs no ActiveX or Silverlight to run.
http://www.youtube.com/watch?v=AU4mH0jPntI
So, the above shows that access can now be used to build scale web sites (you can ignore the confusing answers by the other two posters here they are not quite up to speed on how access works or functions).
However, for your case, I would continue to have the access database on the desktop. You can simply link to tables that are hosted on the web server. Those tables can exist in MySql, or sql server. As long as the web site supports external ODBC connections (many do), then you can thus have the desktop application use the live data from the web server. If connections to the live data at all times is a issue, then you could certainly setup something to send up new records (or the whole table) on some kind of interval or perhaps the reverse, and pull down new records on a interval from the web site (depends which way you need to go). So, connecting to MySql or sql server is quite easy as long as the web hosting and site permits external ODBC connections. I do this all the time, and it works quite well.
As mentioned, new for access 2010 is web site building ability but that does requite Access Web services running on SharePoint.
You don't need to upgrade to Access 2010. One option is to use the EQL Data plugin to sync the database up to the server. Then you can write an asp.net, php, or whatever application that queries the table using the EQL API and prints the results however you want. This kb article describes how to use the EQL API from a web app.
The nice thing is that the database is still totally usable (and at full speed) even when you're not online, and then you can sync the new data up to the web occasionally. It only uploads the changes, not the entire database every time, so it's fast.
Disclaimer: I work at EQL Data so I'm a bit biased. But this kind of use case is the whole reason the company exists.

Webtrends can't read Microsoft reporting services 2008 web log

With the change from IIS to their own web server in SSRS, we are now experiencing problems with using web trends to track our report utilization. Web trends said it was not supported, has anyone found a way to make it work?
Not that I know, sorry.
Usually, you "roll your own" by mining the ExecutionLog table in the ReportServer database. This has lots of useful information on users, parameters, durations, errors etc.
There's far more information here than the IIS logs
I assume you're using the Native Reporting Mode. If you switch it to Sharepoint Integrated mode I would imagine you could get some logging working again.

Resources