Re: Looking for ASP.NET/SQL Server 2000 App Security Recommendations

From: Jeff Smith (jdsmith_nospam_99@hotmail.com)
Date: 08/29/02 

From: "Jeff Smith" <jdsmith_nospam_99@hotmail.com>
Date: Thu, 29 Aug 2002 16:27:58 -0500

Kenneth,

A few ideas:

- Store the connection string in the Local Security Authority (LSA - which
is where most sensitive/secure information is stored by Windows). You can
write a separate application to access the connection string and update it.

- If you want to externalize the info, encrypt with a certificate or a key
pair, store the encrypted string in a file or the registry, and load the
cert/key pair into a Windows account's certificate store/key container. When
you need the connection string, retrieve from the LSA -or- retrieve the
encrypted file and decrypt using the cert/key pair. If you periodically need
to change the key pair or cert, write an application that will reload the
cert or key pair into the account's store.

If you go the LSA route, you'll have to use the Windows APIs (check out the
Platform SDK documentation for more info). There's no API in the .NET
Framework for doing so. Someone may have wrapped it, too.

Jeff

"Kenneth Courville" <kcourville@yahoo.com> wrote in message
news:OHdiqt2TCHA.1240@tkmsftngp12...
I am working on an active directory user management app with an ASP.NET
interface. User account requests are stored in a SQL Server 2000 store,
where there are later processed by a windows service that is more
capable of making the required Active Directory changes.

What I'm trying to figure out now is the best way to secure the
connection between the ASP.NET interface and the data store.

The application already has forms authentication and role-based security
implimented. We have the SQL Server set up as mixed mode security. IIS
allows anonymous connections.

I guess the main question that I'm trying to answer is how should the
connection string information be stored for and accessed by the
application? I know that I don't want to hard code this information.

Any other experiences and insight that you're willing to throw at me for
this particular situation would be appreciated as well.

----------------------------------------
http://members.tripod.com/kcourville0/

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

Relevant Pages

  • Adding Configuration file to a Project
    ... i created a solution with 2 projects, windows forms and class library, both ... don't have Application Configuration File, i think the name should be ... App.Config not sure, i want to store the connection string in it, how can i ...
    (microsoft.public.vsnet.general)
  • Re: Restore Question....
    ... Did you buy computer at a local store or online? ... the updates are listed in my Add/Remove Programs." ... Are the Windows Updates listed -Start, Control Panel, Add / Remove ... About three weeks ago I tried to use the System Restore feature to ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Best Programming Practice?
    ... how well developed applications are and it is a blackmark when an app uses ... MSDN, Windows 2003 specifications, as well as the Windows XP logo ... Store user-created documents under a subfolder of My Documents, ... There are pros/cons to storing user preferences in files, the registry, ...
    (microsoft.public.windows.terminal_services)
  • Re: who is to blame?
    ... as representative for the 'hundreds of millions' windows users ... >>That still does not exclude the possibility that for others Macs would ... you will find my reasons to buy my powerbook. ... Apple has an online store. ...
    (comp.sys.mac.advocacy)
  • Re: Best Programming Practice?
    ... In general, you should follow the Application Compatibility guidelines on MSDN, Windows 2003 specifications, as well as the Windows XP logo specifications. ... Store user-created documents under a subfolder of My Documents, remember, use api to obtain path to My Documents ... There are pros/cons to storing user preferences in files, the registry, or maybe in your database backend if you are using one--consider carefully ... I understand that the home directory is often ...
    (microsoft.public.windows.terminal_services)