CODEWITHSUNDEEP
c#app-config
sazary
sazary

Reputation: 966

how to secure app.config, while it is intended to be used on several machines?

I want to create an application that connects to a central remote database, and this application is intended to be given to several users to use on their computer, in a local network. the main challenge for us is to hide connection string from the users, in order to prevent potentially malicious uses.
thus far i've found that i must use RsaProtectedConfigurationProvider class, described at there to encrypt app.config, and to decrypt it. but i can't figure out how can i give the needed RSA keys to clients? and how all this prevents crackers from finding the key and using it to decrypt app.config?

thanx everyone ;)

Upvotes: 2

Views: 3448

Answers (3)

Zuria
Zuria

Reputation: 1

I came across the same problem these days and found another solution, maybe is not very elegant but it worked for me. I used an AES algorithm to encrypt the connection string with a key defined by me, and replaced the resulting string in the config file. Then I added a decrypting function with the same key in my app and used it on the get connectionstring method, something like this:

public string myConnectionString {
    get {
        return ((new Cypher().Decrypt(this["myConnectionString"].ToString())));
    }
}

The main disadvantage is that these changes may be overriden when compiling, so it's better to do it when you app is ready. I used the methods for encrypting/decrypting that I found here: AES Encryption Decryption (Cryptography) Tutorial with example in ASP.Net using C# and VB.Net

Upvotes: 0

Steven
Steven

Reputation: 172646

the main challenge for us is to hide connection string from the users

You can't let users have client applications that connect directly to the database, and expect to be able to hide the connection string. This can't be done.

If the connection string must stay secret, store it on the server and let client applications connect to a web service, instead of directly to the database.

Upvotes: 4

Oded
Oded

Reputation: 499002

If you read through the web farm secenarios of the How To: Encrypt Configuration Sections in ASP.NET 2.0 Using RSA article on MSDN, you will see how to create a key and extract the private and public keys from it in order to install the public key on different machines.

Summary:

  1. Create a custom key:

    aspnet_regiis -pc "CustomKeys" -exp

  2. Add a configProtectedData section to the config file, to use the custom key

  3. Encrypt the wanted sections

  4. Export the key:

    aspnet_regiis -px "CustomKeys" "C:\CustomKeys.xml" -pri

  5. Copy and import the key in the other machines:

    aspnet_regiis -pi "CustomKeys" "C:\CustomKeys.xml"

Upvotes: 4

Related Questions