What is a good alternative for placing passwords in configuration files?

Question

I have a set of .Net configuration files that contain passwords for Windows service accounts and / or SQL Server login. I would like to get them from configuration files and keep them more secure.

What is a good alternative to having passwords in the configuration file?

thanks

Answer 1

In fact, you can encrypt sections of your configuration files. it doesn’t "separate" from the configuration file, as you asked in your question, but it is more secure than storing unencrypted / unencrypted passwords in your configuration file.

An example of encryption of connection strings (from the command line):

aspnet_regiis -pe "connectionStrings" -app "/SampleApplication" -prov "RsaProtectedConfigurationProvider" 

Please note that the same method can be applied to partitions, except for connection strings.

See the tutorial at: https://msdn.microsoft.com/en-us/library/zhhddkxy%28v=vs.140%29.aspx

To decrypt and encrypt a section of a Web.config file, the ASP.NET process must have permission to read the corresponding encryption key information. For more information, see Import and Export RSA Key Containers with Secure Configuration.

The application will be able to use the encrypted values ​​initially, but if the user had access to the configuration file, say through an archive file, the lines will still be encrypted.

Another tutorial that may contain additional information: http://www.codeproject.com/Tips/795135/Encrypt-ConnectionString-in-Web-Config

Please note that encryption is reversible with the appropriate key. Your safest bet will be to block remote access and share access to the area in which the configuration file is stored. Without any of these, your configuration file should not be accessible to anyone except server administrators.

Answer 2

Not sure if you are dealing with desktop applications or when it comes to web applications. If the first, then I would say that you should definitely encrypt passwords in the configuration file.

If you are referencing a web application, you also have the option of encrypting credentials and storing them in the registry using aspnet_setreg. Then you indicate your location in your configuration file.

It also makes it easy to use different credentials in different environments without changing the configuration file. For example, in your sandbox environment, you have your sandbox credentials encrypted in the following registry key: HKLM \ SOFTWARE \ MY_SECURE_APP \, but on your production servers you have a product identifier encrypted with the same key.