On shared web servers it is usually a good idea to encrypt your connectionstrings element as your web.config may be world readable depending on application pool identities, IUSR identities, and the machine.config trust level. You can do this with the aspnet_regiis utility (errr, your host can do it). Open up a command prompt, change directory to C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 and run the following:
The first command encrypts; replace domain.com with your site name in IIS and the -app switch should be followed by the application name, in this case the webroot:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis -pe connectionStrings -app / -site domain.com
Encrypting configuration section…
Succeeded!
The second and third commands grant read access to the key for decryption. This permission needs to be granted to ASPNET and your application pool identity. The value following the -pa switch can be found in the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config where the RSAProtectedConfigurationProvider name is defined :
<add name="RsaProtectedConfigurationProvider"......keyContainerName="NetFrameworkConfigurationKey"
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis -pa “NetFrameworkConfigurationKey” “ASPNET”
Adding ACL for access to the RSA Key container…
Succeeded!
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis -pa “NetFrameworkConfigurationKey” “NETWORK SERVICE”
Adding ACL for access to the RSA Key container…
Succeeded!
Original:
<connectionStrings>
<add name="stringname" connectionString="Data Source=SERVER;Initial Catalog=database;Persist Security Info=True;User ID=login;Password=password"
providerName="System.Data.SqlClient" />
</connectionStrings>
Encrypted (partially truncated):
<connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>Rsa Key</KeyName>
</KeyInfo>
<CipherData>
<CipherValue>pb74wqH93ZDjJNrHSkRqBJKxvq4eS4MDq+vF2RvWZSFhXBkgBcS...tWmHYi8=</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>KY4ESXL95+AtOAu3QRBURO5ij6GKTUDmosRcQ2YzOGtt8mLGs0wJLONl0i1mA...qJioHKV0tOl3Y=</CipherValue>
</CipherData>
</EncryptedData>
</connectionStrings>
That’s it
admin | 
05 11th, 2009| 
