Re: Web.config encryption in shared hosting scenario

Hello Jazza,

I saw your post because I have a similar problem.

I just begin to search for a solution because the customer does not allow
access to the web server where my application has to be deployed. I would
like to encrypt the database connection string located in the web.config.

Did you found a solution to this problem? Thanks

Sincerly,
Adriano

"Jazza" <Jazza@xxxxxxxxxxxxxxxxxxxxxxxxx> a écrit dans le message de news:
5D099CD8-E572-41F5-A45B-3FDA3A3A1A3B@xxxxxxxxxxxxxxxx
Hi, I am an experienced .Net developer, but new to ASP.Net 2.0.

I have been using the Personal Web Site Starter Kit and have successfully
uploaded the site to a shared hosting provider. I am connecting to the SQL
database via SQL authentication rather than Windows authentication, as I
have
no control over the Windows user accounts. This means the SQL user name
and
password are in clear text in the connection string in web.config.

Therefore, best practice dictates that I encrypt the web.config file to
hide
the SQL login details. But the only way to encrypt a section of the config
file is to run aspnet_regiis.exe on the server, to which I have no access.

What are my options, if any, for protecting my config file? Does anyone
know
of any resources on how to create a custom encryption scheme?

Regards,

Jazza


.

Relevant Pages

  • Re: Help Encrypting Connection String
    ... but I have to do it on SQL Server instead of SQL ... If I'm retrieving the connection string in my own code, ... > in 2.0 you can encrypt nearly all config section out of the box using the ... >> the config file, but .NET 2.0 has more options. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ASP.NET 2005 connection string
    ... their credentials once. ... variables as part of the dynamic connection string that's in the ... If you do need to encrypt it, there are a bunch of options in .NET 2.0. ... string to our SQL Server in the web.config file? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ASP.NET 2005 connection string
    ... connection string in this case. ... Since the conn string will be built ... If you do need to encrypt it, there are a bunch of options in .NET 2.0. ... string to our SQL Server in the web.config file? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: local admin account password
    ... > encrypt the database and create alerts in the event of unsuccessful ... >> no more recovery console and don't think cached logins will work. ... >> The DB file would be encrypted with EFS so only the limited user SQL ... >> itself doesn't really need to be secure as the authentication is based ...
    (Focus-Microsoft)
  • Re: OOP - a question about database access
    ... >>and project so much better in SQL DBMSes than in ODBMSes, ... >>100x more bytes from the database, just because you want your objects to ... > a related invoice.. ... > assoication from the customer to the invoice collection and have done ...
    (comp.object)