dbFront.com - Recent questions and answers in Installation

Answered: Is a distributed install really 100 times more secure?

Mon, 23 Feb 2026 23:43:24 +0000

Assigning relative risk is very complex. See Quantifying Relative Security of Design Decisions and Quantifying the security effectiveness of firewalls and DMZs.

Below is our justification for the statement that: "A distributed server setup can be 100 times more secure than a single server setup."

Single Server

A single-server has to host all of the services, which means that it automatically presents a larger attack surface. Each extra service represents another area that could be misconfigured or exploited via some bug. Each service could be used as a stepping stone to compromise the server.
A single-server forces the Authentication, Database and other services to be directly accessible in a high-risk environment, even if the single server is hosted inside a DMZ.
A single-server is difficult to monitor for suspicious activity because of the complex array of things it must already do.
A compromised single-server will expose far more information, including: application configuration, connection credentials, API keys, and much more. Each extra bit of information, or exposed configuration represents another opportunity to exploit.
A compromised single-server directly connects to more services: database, security (AD, LDAP, etc..), file, printer; all of which are now exposed and available for lateral movement. Again, each extra opportunity and connection makes it that much more likely that an attacker can advance to their end-goal.
Most of the attack vectors (Web, Database, AD, LDAP, Fileserver, Printer) are well-documented and repeatedly targeted by automated attacks.

NOTE: The keys can be encrypted, but they can't be hashed since the server needs to decrypt the credentials and keys to use specific secured resources. If the server can decrypt the keys, then a hacker could gain that access as well.

Distributed

The web-server in a distributed setup represents the smallest target since only a web application is installed.
The web-server in a distributed setup is much easier to monitor due to its simplicity and limited activity range.
If compromised, the only information gained is the IP address of the Application Server. No application configuration, database credentials, AD credentials or other security-sensitive information is exposed.
If compromised, the web-server provides ZERO opportunity for lateral movement since the web-server can operate within its own highly limited security island,
If compromised, the attack becomes increasingly complex as hackers next need to compromise a restricted Application Service across a firewalled port before they can even begin to attack their next target.
Separating the Web Application and Application Service, allows the Application, Database and Authentication services to operate from a more secure environment.
This separation blocks insider threats by requiring high-level admin access for access to protected systems.

Calculation

Increases in attack surface and exposed information/access are not simple additional risks. Similar to the game Minesweeper, a single opening can reveal many avenues of attack or nothing. Again, similar to passwords, a single character removed makes a password significantly easier to crack. The scale is exponential.

A suggested base is to start at 1.5 and multiply by 1.5 for each additional risk, (1.5^R) where R is the sum of additional risk areas. No attempt was made to weigh the relative strength of each risk. There are just too many factors to consider.

The following additional risk areas are attributed to a single server install:

Increased Surface (3): Application Service, Print Services, Authentication Services,
Exposed Resources (4): Application Config, Connection Credentials, API Keys, Network Access,
Lateral Movement (4): Database Servers, Additional Network Appliances, Security Servers, File Servers,
Attack Automation (1)
Insider Threats (1)
Monitoring Difficulty (1)

The rough sum of additional risk areas is 14, some very significant. This calculates to an additional risk of (1.5^14) = 292 times. Choosing to remain conservative, we published 100 as our estimate.

This calculation is not exact science. The whole point is to trigger discussions and clear thinking about balancing the risks and costs of infrastructure decisions.

The root question is: Is the reduced risk worth the extra infrastructure and costs? To answer that question you need to be able to quantify the relative risk, even if only roughly.

This answer is here in the QA to make discussion easier.

Answering Objections

Q: Can't I move the database into a secured environment?
A: That helps but only partially because the database API and credentials still need to be exposed to the Web Server. Databases, by design, expose all of their functionality via their network-accessible API.

Q: Can't a VPN secure our internal Web Servers?
A: A VPN is a significant asset, but it only represents a single link in the security chain. A compromised user or user account allows direct web server access.

Answered: How to Disable Specific Protocols in dbFront

Thu, 12 Feb 2026 19:51:23 +0000

As of 1.4.2.0683, dbFront will check the registry to see if a protocol is disabled before using it within dbFront.

The registry key it checks is the following. This key is also monitored by other windows services.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"Enabled"=dword:00000000

Setting [`Enabled`] to [`dword:00000000`] will disable this protocol.

Any change to this registry key will require a restart of both the dbFront Service and the dbFront Web Application. It is recommended to restart the entire server so that all applications and services including IIS are updated.

NOTE: If your dbFront install is distributed over multiple servers, then all servers will need to be updated accordingly.

Answered: Enable SSO and User Authentication at the same time

Wed, 27 Nov 2024 16:29:58 +0000

At the moment that is going to require two separate installs of dbFront because SSO mode is naturally an exclusive option.

When SSO is enabled then dbFront won't show a login screen. If dbFront encounters a user that needs authentication it will redirect that user to the configured SSO provider. It is the SSO provider's responsibility to authenticate the user and then return them to dbFront.

It is possible to update dbFront so that it could provide a different authentication option depending on the URL, but that has not been implemented at this point.

Answered: The Service and UI versions of dbFront don't match!

Mon, 08 Jan 2024 15:11:00 +0000

There are two installed portions of dbFront and both of them need to remain in sync:

The Windows (Service) that is normally installed in the folder
[C:\Program Files (x86)\dbFront\] and,
The Web Site (UI) files that are normally installed in the folder [C:\inetpub\dbFront\]

The dbFront Installer should normally update both pieces at the same time when you install a new version.

Sometimes the installer may fail to update either the Service or the UI. The following are some of the reasons.

A) When running the installer it is possible to Un-Select, the option to update specific features, [Windows Service] or [Website Files]. This would normally be appropriate if you were to distribute the dbFront install across multiple servers.

B) The initial install files were moved to a non-default location and the installer can't find them to properly update them.

If you are unable to resolve this issue then please contact us at support@dbFront.com, and we would be more then happy to help.

Answered: HTTP Error 404 after installation when accessing localhost/dbFront

Mon, 19 Dec 2022 17:12:37 +0000

One possible reason is the website bindings.

Open "Internet Information Services (IIS) Manager"
Open the "Default Web Site"
Open the web application "dbFront"
Look at the list of URLs that you can use to browse the web site.

If "localhost" is not included in the list then you need to add it to the bindings.

Open "Internet Information Services (IIS) Manager"
Right-click "Default Web Site"
Click on "Edit Bindings"
Add an entry for Type="HTTP", Hostname = "localhost", Port=80

Answered: How do I configure SSL for a server that is hosting dbFront?

Wed, 24 Nov 2021 16:25:25 +0000

Configuring SSL for the server is something that is normally managed by your network team.

After SSL Certificate Installation

Once an SSL certificate is installed you should check the following two items:

1. Server Bindings
Once SSL is enabled on the server then you will need to ensure that the Bindings within IIS were updated to enable SSL for the Website.

Bindings are discussed as part of this article: Microsoft Instructions using IIS Manager

2. Secure Cookie Flag
The only SSL-specific configuration within dbFront is a security setting to force dbFront to send all cookies via SSL. The Secure Cookie Flag should only be enabled once SSL has been configured on your server. For more details see: SSL Cookie Flag

Installing a SSL Certificate

There are four main options for setting up SSL on your server.

1. Self-Signed SSL Certificate

You specified https://servername/dbfront as the URL which means you are likely talking about a locally hosted internal server. For that scenario, you could use a self-signed SSL certificate.

The following instructions specify how you can create and setup a Self-Sign SSL certificate for local network use.

Microsoft Instructions using IIS Manager

2. Traditional 3rd Party Public SSL Certificate

The traditional way to install SSL is to purchase an SSL certificate from companies like Comodo or Verisign. The following article describes the process of purchasing and installing such a certificate. You can also search for vendor specific instructions.

Instructions for Installing a 3rd Party SSL Certificate

3. Free SSL for Public Sites using CloudFlare

CloudFlare is a company that provides enhanced DDOS protection for sites. As part of their services they also give all clients. including free clients, access to a Free and very robust SSL implementation.

We use CloudFlare to protect our primary site and our demo/test sites.

4. Free SSL for Public Sites using LetsEncrypt

LetsEncrypt is a very popular free SSL certificate issuing service. Their certificates have a short lifetime but they are automatically renewed using installed clients.

We also use LetsEncrypt internally and have used LetsEncrypt for Hosted Client servers.

Free SSL Clients for LetsEncrypt

Error after upgrade: "Can't load lookup data for [foreign key] - Value can't be null"

Tue, 18 May 2021 19:28:10 +0000

We tried to upgrade DBFront from 1.0.15.5851 to the latest. The installation went fine, but we got the following error on some tables:

"Can't load lookup data for [foreign key] - Value can't be null"

In a lot of cases where we didn't have lookup tables previously, we added them so that DBFront could generate dropdown tables for acceptable values. We did this in a quick and non-standard way - we left the values in the main table as is, got a distinct list of values, and created a new lookup table with this list. One of those values (for a number of tables) was null, which I assume is causing the problem above.

Is there a quick fix for this on your end (since this worked before), or will we need to create IDs and more proper lookup tables?

Thanks.

Answered: What are the minimum requirements for running dbFront?

Sat, 20 Feb 2021 03:25:42 +0000

The minimum requirements to run dbFront are:

A windows workstation or server running Windows 7, Windows Server 2012 or better,
At 2 gig of RAM if the server is not running the database, 4 gig is better,
At least 2 CPUs, especially if the server is also hosting the database,
dbFront uses a negligible amount of disk space.

dbFront also requires access to a database server. The database server can be local or remote. If the database is remote then the database connection should be very fast with low latency. The database server options are:

Microsoft SQL Server,
MySQL,
Oracle

You can install everything required for dbFront on a single server or you can perform a distributed install.

For more details see: https://dbfront.com/setup

Answered: How do I install software on client machines on Pro version

Thu, 12 Nov 2020 20:08:09 +0000

dbFront is a web application. This means that your clients should be able to access dbFront by simply browsing to your server. No additional installation or licensing is required.

1) http://localhost/dbFront

While running locally on your server you can use the URL http://localhost/dbFront, but this URL only works when you are running directly on the hosting server.

2) http://%YourServerName%/dbFront

Your local network clients would connect by browsing to your server using the URL http://**%YourServerName%**/dbFront, where the value %YourServerName% would be replaced with the name of the hosting server or workstation.

This of course assumes that there is a network connection between your server and your clients.

Answered: HowTo debug IIS FastFail errors

Sat, 24 Oct 2020 01:22:32 +0000

The following is a list of methods and tools to debug what might be causing IIS to fall over.

IIS and dbFront Logs

The following folders might provide helpful logs:

System Eventlog
IIS Logs: c:\inetpub\logs\

Although dbFront generates its own logs, they are unlikely to help with startup failures since dbFront would not have had the chance to log anything.

dbFront Logs: c:\logs\

Enable IIS Logging

See: How to enable logging in Internet Information Services (IIS)

Enable IIS Tracing

Answered: How can I compare a before / after IIS configuration.

Fri, 23 Oct 2020 22:57:32 +0000

Starting with IIS 7 there is a built-in method of capturing IIS configuration changes using AppCmd.

The AppCmd documentation can be found at Getting started with AppCmd.exe

Creating a Backup

The steps for taking a backup are:

Open an Admin Command Prompt.
Browse to the folder c:\Windows\System32\inetsrv\
Run "AppCmd add backup"

Complete Changes

Once a backup is created you can then make your configuration changes.

After the changes are complete then take another backup as explained above.

Comparing the Backups

The simplest way to compare the configuration backups is to download and install a free program named WinMerge. WinMerge can be found at Winmerge.org.

Once installed then:

Open the folder "C:\Windows\System32\inetsrv\backup" in Windows Explorer,
This is a protected folder so you need to specify that you really want access,
You will then see two or more dated folders containing the backups,
Select the two folders you want to compare and right-click and open in WinMerge.

Winmerge will clearly show all of the changed files and allow you to browse in and view the actual configuration changes.

Answered: HTTP Error 500: This page can't be displayed

Thu, 13 Feb 2020 14:56:08 +0000

This is a generic error page that IIS uses to hide the actual error. You will need to update the webserver settings to display the real error message so that we can resolve it.

Please see the following Stack Over Flow article: Showing Detailed Error Messages

Answered: How do I completely reinstall dbFront?

Tue, 19 Mar 2019 15:22:19 +0000

The following are the steps needed to reinstall dbFront while still retaining the settings. Please read all of the instructions before starting.

The following instructions assume the default locations.

1) IMPORTANT: Please backup the following file and folders prior to uninstalling.

The contents of the [C:\Data\dbFront\] folder
C:\Program Files (x86)\dbFront\dbFrontService.exe.config
C:\Inetpub\dbFront\web.config

2) Delete the dbFrontService files in [C:\Program Files (x86)\dbFront\]

3) Delete all dbFrontUI files in [C:\Inetpub\dbFront\]

4) Delete the Log Folders

C:\Logs\dbFrontService\
C:\Logs\iisexpress\
C:\Logs\w3wp\

5) Ensure that the App Pool and WebApp are removed. This is to ensure that a reinstall is able to recreate the website properly.

6) Restore the [C:\Data\dbFront\] folder which you backed up in step a).

7) Reinstall dbFront.

8) Merge in the [C:\Program Files (x86)\dbFront\dbFrontService.exe.config] file backed up in step a).

Note: Only merge in the sections as needed.

9) Merge in the [C:\Inetpub\dbFront\web.config] file backed up in step a).

Note: Only merge in the sections as needed.

All the best.

Answered: How do I rollback to a previous version of dbFront?

Mon, 12 Nov 2018 14:37:27 +0000

If you have the option then a Backup or Virtual Machine Snapshot is always the preferred option for rolling back to previous versions of Software updates since the results will be more reliable.

If that is not a viable option then rolling back to a previous version of dbFront should be straightforward in most cases. Older versions of dbFront should simply ignore the configuration data for the new functionality provided by newer versions of dbFront. In the event that there is a conflict then older versions of dbFront should be able to revert to valid default values.

Note: The following instructions assume that dbFront was installed to the default locations. You will need to adjust the paths for your environment.

The objective is to manually delete all executable files (.exe, .dll) because and older installer won't replace newer executable versions with older versions. At the same time you want to keep the configuration files, and especially the two *.config files.

To revert to a previous version of dbFront please do the following:

Stop the "dbFront Service":
net stop dbFrontService
Delete the dbFrontService executables:
C:\Program Files (x86)\dbFront\ .exe
C:\Program Files (x86)\dbFront\ .dll
DO NOT DELETE any *.config files.
Delete all of the following dbFrontUI files:
C:\Inetpub\dbFront\bin\ .dll
C:\Inetpub\dbFront\css\ .css
C:\Inetpub\dbFront\js\ .js
C:\Inetpub\dbFront\ .ashx
C:\Inetpub\dbFront\Site.Master
DO NOT DELETE any *.config files.
Once you have removed the newer files then you can download and install the dbFront version of your choice.

Please test the updated install to ensure that it is solid.

Answered: Connected to MySQL, but can't see any database, or table

Sun, 27 May 2018 01:30:28 +0000

The connection appears to be valid because you can see the Information Schema.

Therefore it appears to be a security issue. Please check to see if the user you used for the connection has select access to the tables you want the dbFront application to have access to.

Answered: Logon failure: the user has not been granted the requested logon type at this computer

Tue, 12 Dec 2017 17:37:25 +0000

This error means that there is a mismatch between the Logon Rights permitted for that user and the LogonType that is requested by dbFront.

dbFront allows you to specify how it should process the Logon requests. To see where that is set please see: Application Service Setup

By default the LogonType of 2 (Interactive) is used. This means that the user must have the privilege to complete an interactive logon (e.g. at the console or RDP)

Depending upon the scenario this might be considered dangerous since you don't want users to be able to logon to the server.

For that reason many networks give those users Network access. That would equate to the LogonType of 3 (Network).

For more details on the different LogonType's see: http://techgenix.com/Logon-Types/

To manage a users Logon Rights you can use an old Windows 2003 Resource kit utility named NTRights. This utility still works on current versions of Windows. More details can be found at:

Answered: "HTTP Error 403.14 - Forbidden" error - A default document is not configured for the requested URL...

Mon, 11 Dec 2017 18:07:26 +0000

IIS will return the "Forbidden" error when it can't find a default web page to serve and directory browsing is disabled.

A wrong and dangerous solution is to turn on directory browsing as IIS and other helpful articles might suggest.

The most likely problem is that IIS is not fully setup to serve Dotnet webpages and so it can't find the dbFront application.

It might also be that when IIS was installed or upgraded that the entry "default.aspx" was missed or removed from the list of default documents. Please open the entry "Default Document" and view the list to ensure that "default.aspx" is included in the list.

For complete details on setting up IIS please see: Preparing Windows to host a Dotnet 4.0 website

Answered: Lookup from large table / pre-filtering a field based upon another field

Thu, 16 Nov 2017 16:45:49 +0000

For detailed instructions on creating a cascading dropdown or lookup see: Cascading Lookups/Dropdowns

As an added note: The dropdowns in dbFront are searchable and can handle 1 million + rows.

Answered: Error opening database preferences: Can't get fields from driver

Thu, 12 Oct 2017 17:45:02 +0000

As of version 1.0.2.9695, dbFront will catch the Null DataType error and allow you to continue.

Answered: Tcp channel protocol violation: expecting preamble.

Fri, 22 Sep 2017 16:13:14 +0000

The dbFront Web Application is hosted by IIS as one of many web applications. By default the dbFront Web Application uses port 42057 to communicate with the dbFront Service.

This error means that the dbFront Web Application attempted to talk to the dbFront Service and received an invalid response.

The most likely cause is another service which uses the same port as requested by dbFront. You can easily instruct the dbFront Web Application and Service to use a different port.

To view which ports are in use you can run the following from an Administrator prompt:

netstat -an

Once you select another port then you will need to updated both portions of dbFront with the same port number. For instructions see:

NOTE: Don't Use Web Hosting Ports.

Ports 80 (HTTP) and 443 (SSL) are reserved for use by IIS (Microsoft Internet Information Server) and other web servers. Those ports are used when browsers connect to a web server.

Answered: Installation Prerequisites

Wed, 14 Jun 2017 14:38:23 +0000

There is no known incompatibility between dbFront and SQL Server 2016 running on Windows Server 2016.

I will upgrade one of my servers to Windows Server 2016 and test that scenario over the weekend.

Update: I have verified that dbFront works just fine with SQL Server 2016 running on Windows Server 2016.

Answered: Oracle Database Connection

Wed, 31 May 2017 04:58:28 +0000

In the server name field you can enter either:
servername
servername/servicename
servername:port/servicename

For more details you can see https://dbfront.com/oracleinstall

Note: If you are intending to connect to Oracle, then please download the latest beta version as it contains a number of important Oracle fixes. The minimum version you should run is 1.0.2.6468

Answered: receiving iis7 page on first login after install

Sat, 04 Mar 2017 11:02:29 +0000

This issue was resolved with an updated installer in dbFront 1.0.2.4134.

The updated installer also makes it easier to diagnose failed installations.

Answered: dbfront run on Mac?

Fri, 16 Dec 2016 16:11:51 +0000

Because dbFront is a web application, users of dbFront can use any OS including mobile devices like an iPad or other tablets.

Hosting dbFront requires a Windows server to host the Web Application and the Service.

For specific requirements you can see: http://dbfront.com/iisinstall

Answered: How do I migrate all of my dbFront work over to another server?

Sat, 16 Jul 2016 13:20:44 +0000

dbFront now has the ability to export the database settings to a file which can then be transferred to another server and imported.

The process to migrate your settings to a new server are shown below. The default folders are show in brackets.

a) Setup dbFront and check configuration.

Install dbFront on the new server and register it. (Automatic 30 day license to test and validate)
Compare dbFrontService.exe.config, compare old with new. (c:\program files(x86)\dbFront\dbFrontService.exe.config)
Compare web.config, compare old with new. (c:\inetpub\dbFront\web.config)

b) Copy Database Configuration

Create the database connections on the new server.
Export the settings from the old server. You will need to specify a database. See: Export/Import
Ensure that only the settings are being exported.
Import the settings at the new server. You will need to specify the destination database.

c) Copy Support Files

There are additional files that may also need to be moved.

Excel Templates (c:\data\dbFront\Excel)
Crystal Reports (c:\data\dbFront\CrystalReport)
Quick Reports Templates (c:\data\dbFront\Reporting)
Custom Icons or CSS files (possibly c:\inetpub\dbFront\, images\, css\)

For more details see: Export/Import

Answered: How to backup dbFront before an upgrade. I don't want to lose my settings.

Sat, 09 Jul 2016 10:36:37 +0000

It is always a great idea to do a backup before performing an upgrade.

Backup Options

a) Virtual Machine Snapshot

The best possible option is to take a Virtual Machine snapshot. This allows for a quick and complete restore if the dbFront install fails for any reason.

b) Regular Server Backup

Regular server backups are a good option, but restoring a server backup can be a complex task.

c) Selective Folder Backup

Assuming a default install, the dbFront folders that should be backed up are:

Service Folder: c:\program files(x86)\dbfront
Website Folder: c:\inetpub\dbfront
Data / Settings: c:\data\dbFront

To manually backup your IIS settings see: Backup and Migrate IIS Configuration

Upgrading dbFront on a Default Install

To upgrade dbFront you should be able to just run the dbFront installer and do a regular install and it will upgrade the service and the website files without damaging your setup. But just in case you should run a backup first.

You only need a custom install if you manually installed dbFront initially.

Answered: Can dbFront be hosted by Azure, GoDaddy, or Amazon AWS?

Wed, 12 Aug 2015 02:08:53 +0000

dbFront can be hosted on your own hardware or hosted in the Cloud using a VPS or VM plan. Plans that have at least 4 gig of ram and 2 cores are sufficient for many applications. One recommendation is to keep the dbFront install close to your database with minimal latency to ensure good response times.

The regular Windows Web hosting packages are too locked down and limited to allow dbFront to run because dbFront is both an IIS hosted Web Application and a Windows Service.

The Windows Service maintains the application state and allows dbFront to run in highly secure environments because it ensures that the Web Application never has direct access to the database or authentication services. In highly secure environments the Windows Service is installed on a separate server inside a protected network. See: Distributed Setup

Some vendors used by my clients are:

Microsoft Azure (azure.microsoft.com/en-us/products/virtual-machines/),
Amazon AWS (aws.amazon.com/getting-started/hands-on/launch-windows-vm/)
HostWinds (hostwinds.com/vps/windows),
and GoDaddy (godaddy.com/hosting/windows-vps).

If you need help getting dbFront working in a VPS environment then let us know. We have already made this work for others.