Using asp_regiis.exe to secure connection string

Question

using asp4 mvc 3 building web app.

I am deploying a web app outside the company firewall, so I want to secure the connection string to the database in some way. The connection string is in the web config.

Do I even need to do anything? Meaning is there already built in stuff, it will be sitting on Windows Server 2008, using IIS7.
One option I have been looking at is using the asp_regiis.exe tool, but I have questions due to conflicting info in tutorials:

a. If the code is on my box and I run the tool, do I need to rerun it after it is deployed to server?

b. Some tutorials say the decrypt is built into the framework, so once I to the one time encryption using the tool, I don't have to worry about it, but one or two talk about how to decrypt, so I am not sure if it automated. Is it?

c. Do I have to do any setup on the server at all, like tell the app pool it using an encrypted web config file?
Is there a way to just encrypt the password? Maybe on creation of the model.edmx file? I am more than happy to delete it and recreate it if there is.

klings · Accepted Answer · 2013-06-12 22:33:31Z

1

The best option would be to use the aspnet_regiis tool to encrypt the configuration, as per Walkthrough: Creating and Exporting an RSA Key Container.

To run down your list:

Yes
Good option!
- a. You'll need to import the key container on the server, so it can decrypt the configuration. Remember to grant the apppool user access to the container.
- b. Yes, decryption is automatic when your application starts up.
- c. Apart from deploying the encrypted configuration and importing the key container, no.
That would be cumbersome, as you'd have to manage the encryption keys yourself. Go with the encrypted configuration section instead.

answered Jun 12, 2013 at 22:33

klings

9736 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

RichardD Over a year ago

Am I correct in thinking importing the key container on a shared server to which I don't have access to command prompt is going to be awkward? "5.On the second server, open a Command Prompt window. and then enter the following command to change the directory to the .NET Framework version 2.0 directory:"

klings Over a year ago

@RichardD yes. This approach requires that you have access to the server.

Collectives™ on Stack Overflow

Using asp_regiis.exe to secure connection string

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related