Implications of using domain\computername$ account to serve SQL data to IIS

Question

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5).

The application connects to a SQL Server database back-end via a single SQL logon account:

Domain\Computername$

It is mapped to a User account of the same name within a single database, and given the following roles:

db_datareader
db_datawriter

Windows Domain users are then somehow authenticated and allowed access to the DB.

Does anyone know if this presents any significant security risks if the web server (but not SQL server) is publicly accessible on the net? It sounds to me almost as bad as giving those privileges to NT AUTHORITY\ANONYMOUS LOGON, but I must admit I'm not exactly clued-up in this area.

Answer 1

It makes no difference to the security of the web server.

In this case, the account you're connecting with will be the machine account, because the web application is likely running under the context of either:

1. The Network Service account
2. The AppPoolIdentity account.

In either case they're limited non-interactive accounts, and since the application is already running under the context of one of these accounts, there is no additional exposure to the web server or network that will be created by using the same account to access the database. The expose to the database (and database server) will be determined by how you configure this accounts access, is is no different than the exposure created by using any other account configured the same way.

As to adding the account to the db_datareader and db_datawriter roles, that's not unreasonable. It would be better if all data access were done through stored procedures and you could limit the account to the public role, but if it needs to directly access the underlying tables, then that is the minimum permission set required to access and update data and it's not terribly unsafe. It does make it more important to account for any potential SQL injection attacks in your app.

Answer 2

If your web app is compromised the attacker will normally get the same privileges as the user running the application. From what it sounds like that would be a domain user. Also, it sounds like they would have read and WRITE access to your database. Depending on what's in there you may not want that.