The DataDirect for ODBC drivers support a few different methods for specifying the information used to connect to a database. These methods include data sources, connection strings, and files defined by the database vendor. Each of these methods have unique characteristics that require a different set of security best practices to be applied.

Data sources

A data source is a collection of information that is used to establish a connection. Data source information is associated with a data source name and stored on the local system.

On Windows systems, data sources are stored in the Windows Registry:
  • User Data Sources are stored in the HKEY_CURRENT_USER section of the registry. The information in a User Data Source is accessible only to the user that defined or owns the data source.
  • System Data Sources are stored in the HKEY_LOCAL_MACHINE section of the registry and are accessible to any user that can access the system.
For better security, we recommend using User data sources, unless the data source needs to be shared with multiple users.

On UNIX and Linux Systems, data source information is stored on a file, typically an odbc.ini file, in the local file system. The permissions for this file must be set to restrict access to only the user(s) that need it.

Connection strings

An application can use a connection string to specify the information needed to establish a connection. When a connection string is used, the application passes all of the connection information to the driver. There is no connection information stored on the local system. Using a connection string gives the application control over where and how the information is stored.

For more information, see the "Secure connection strings" section in "Secure connection option settings."

Database vendor files

Some database vendors support configuration files that can be used to store connection information for their databases. For example, the TNSNames file can be used to configure connections to Oracle databases. Best security practices dictate that the permission for the vendor specific file must be set to restrict access to the file to only authorized users.