Secure, portable, encrypted configuration values ​​- maybe?

Question

I'm just wondering if anyone has any great ideas on this.

We have many Windows C # services. Each application is installed on several computers (anywhere from 2-80, depending on the application).

Due to network security settings, we cannot (sequentially) use Windows authentication on SQL servers, so our connection strings and credentials have actual usernames and passwords.

Our infrastructure specialists want to be able to do the following when deploying software: 1) Edit the configuration once - set the appropriate server, user and passwords for various database connections. 2) Connect the connection strings (at least) with encrypted or otherwise unreadable to the naked eye 3) Copy this configuration file to all installations of the specific software. This means that encryption cannot be tied to a specific machine.

Can DPAPI do this? Is it possible to install one set of keys for all purposes in order to allow decryption of the common configuration file? How is the configuration edited in this case? How to get other users to view the encrypted configuration in the same way?

Answer 1

DPAPI uses encryption <machineKey>as a private key.

Option 1) You can update this in the machine.config file of each server and set it machineKeyas identical. This has a big impact on the server, for example, with unrelated applications dependent on machineKey.

Option 2) You can override <machineKey>in web.config for a narrower scope.

<machineKey>, , , viewstate . - , .

MachineKey ASP.NET 2.0

Answer 2

, , , .

/ :

<value>:secret_password</value>

- . , , , .

, , .

Answer 3

It sounds like work for an X509 certificate .