CODEWITHSUNDEEP
asp.net-mvcvb.netasp.net-mvc-3
user1477388
user1477388

Reputation: 21440

Published MVC site, How to Password Protect Databases?

Here are my connections strings:

  <connectionStrings>
    <add name="ArticleDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="BlogDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="CompanyDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="UserProfileDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="ApplicationServices" connectionString="Data Source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb1.mdf;User Instance=true" providerName="System.Data.SqlClient" />
  </connectionStrings>

I was reading this http://msdn.microsoft.com/en-us/library/ms181873(v=vs.90).aspx on Considerations for Implementing Applications.

I believe I should put passwords on these and then encrypt. Is that correct, and how do I do it after the fact? Is there any concern with putting passwords in my web.config file? I read something about decompilers being able to read your passwords... Is this a real threat? What can I do to secure this app?

Upvotes: 3

Views: 361

Answers (2)

oleksii
oleksii

Reputation: 35925

You should always encrypt sensitive information stored in a config file. You can do it programmaticaly or via aspnet_regiis (see docs for more details).

Why?

Because people can download a web.config file in plain text through different vulnerabilities and then they can read all the connection strings, user names, passwords etc.

Possible attack list:

  • MS10-070 with a video
  • Any other user on the machine can read web.config. This adds a huge list off all disclosed and non-disclosed attacks on the OS itself.
  • Attack on the IIS FTP and subsequent web.config transmission, for example this one

Upvotes: 3

Adrian Thompson Phillips
Adrian Thompson Phillips

Reputation: 7148

Probably not. The passwords in a web.config file usually expose authentication details for connecting to remote SQL servers (or other database). This is the sort of thing you'd want to protect.

Your database files are of the file variety (stored locally ) and your SQL Express database is accessible using integrated security, so I'd say that you're okay to leave thing as you are.

Upvotes: 1

Related Questions