Installing Office (Excel) on database server - security conserns

Question

Installing Office (Excel) on database server - security conserns

Diske

Old Hand

Points: 366
More actions
February 18, 2019 at 6:47 am

#381477

Hi,
Is there any security issues to consider, if installing Office on a database server,
The question is not regarding cost, stability or features, but about which damage can be done with, e.g., macros/Excel
We want to create/write to Excel files using SSIS/C#, and format these files as we wish.
Peter

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

Lowell SSC Guru Points: 323518 More actions · Answer 1

there is no need to install office on a server.
SSIS will use the ACE drivers to create excel documents, so there is no need to install Office , and tie up a license.
google "Office ACE Drivers", and install either the 2010 or 2013 or 2016 redistributable, depending on your desired version, in order to put only the providers in place to support SSIS.

Lowell

--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

frederico_fonseca SSCoach Points: 16157 More actions · Answer 2

Add to this that Installing Excel on a Server is not supported by Microsoft and you would also have issues with licensing in that anyone accessing that server would require an extra license.

Ace drivers as mentioned below is one option for most things, for others installing Open XML https://docs.microsoft.com/en-us/office/open-xml/open-xml-sdk and coding in C# with it.

Diske Old Hand Points: 366 More actions · Answer 3

Thanks to both of you for input.

ACE does not give me opportunities for delete rows, make text bold or color lines etc.Does Open XML provide that functionality (not as I see it)?

Regards

Peter

frederico_fonseca SSCoach Points: 16157 More actions · Answer 4

Diske - Tuesday, February 19, 2019 3:12 AM
Thanks to both of you for input.
ACE does not give me opportunities for delete rows, make text bold or color lines etc.Does Open XML provide that functionality (not as I see it)?
Regards
Peter

OpenXML allows you to do all that - but not necessarily on a easy way - see one example for delete column here https://ankushbhatia.wordpress.com/2011/06/13/how-to-delete-a-column-in-excel-using-open-xml-sdk/

Being a full blown programming API there is a learning curve but for most things it will work as desired.
Only thing that you will not have any supported way to do is to run macros - for that you need either Excel on the server (unsupported and licensing issues) or Excel Services (on sharepoint and/or Office Web Apps Server).
Even these 2 have limits and the way to do things is again another learning curve and development environment.

Steve Jones - SSC Editor SSC Guru Points: 736270 More actions · Answer 5

I wouldn't install office as this increases surface attack area and creates the need for patching here. Install Office on any other machine and let that machine do the work of manipulating Excel docs.

Lowell SSC Guru Points: 323518 More actions · Answer 6

this might be a case of you being familiar with using the Excel automation hammer, and everything looks like a nail....

a lot of what you pointed out can easily be done in an SSRS report, and would be a lot easier there.
hide a column based on all column values meeting a criteria..changing a font or cell color based on a condition...
it's just a formula on the font property, or visibility property, etc.

we are lucky in that there is usually more than one way to do the same job, SSRS sounds like a solid option so far.

Lowell

--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!