I have an application, where I should connect to a SQL Server. It is protected by password. So when I'm starting program for the first time, I'm creating dynamically connectionString and save it in app.config. For the next times I can use created connectionString. I've googled and decided to do following: encrypt connectionString in app.config and save password in my code. When I would like to connect to database next time, I will decrypt connectionString, add userId and password and connect with new connectionString to server. Before closing program, I will delete userId and password from connectionString and encrypt it again. But I have some questions:
1) Is it a good solution?
2) When I am starting program for the first time, I need to create connection string, so somewhere in code should be userId and password. How to deal with this problem?
As I understand you create connection string dynamically. So you can encrypt this section from code as well. The encryption algorithm by default will use your machine key to encrypt the section, here is the link how to do it http://www.dotnetcurry.com/ShowArticle.aspx?ID=185
Before closing program, I will delete userId and password from connectionString and encrypt it again
That's not a good solution. Your data should always be encrypted or at least be lost on program termination. If your user kills your program using the task manager (or it simply crashes), and you rely on the fact that your program will encrypt data on exit, your data is left unencrypted.
You could encrypt the whole connection string at the point you get the username and password. Then, any time you want to connect, decrypt it, pass it to the required functions and get rid of it. Never persist it in an unencrypted way.
Create DBUsername, DBPassword and other DB entries as keys in the app.config. For the DBPassword, encrypt it (symmetric probably) using a master key that is hard coded in code. This is generally enough. There are other ways such as the use of a key store to store the key.
If you don't want to construct the conn string each time, create the app config entry holding the entire connection string and encrypt the whole thing with the master key (I see no value here).
If you're using windows and the credentials are the same as your windows authentication, you can omit the username and password from the connection string and replace it with Trusted_Connection=true
Related
Recently I am working on an .Net project. We used EF to handle SQL, when we make an installer of the program, we realize that app.config is visible which mean that the connection string is not safe.
I am looking for a way to add connection string (or maybe secret code and username) to the EF so that the connection string is not visible.
Something like change old code from this
Using db As ConnectDb.adoSentoEntities= New ConnectDb.adoSentoEntities
'TODO
End Using
to this
Using db As ConnectDb.adoSentoEntities= New ConnectDb.adoSentoEntities(ConnectionString)
'TODO
End Using
But since we used connect code to SQL all over the place, changing every single line of code is not possible. There is a way I only need to add connection string once?
You’d be better off encrypting the connection string section in the app.config. You wouldn’t need to make any changes.
Storing any sort of configuration in an assembly can be read using a hex editor.
It’s been answered on here before.
Encrypting Connection String in web.config
You’d be better off using a trusted connection if you’re using SQL Server. The user running the app would need to have permissions and no username and password is required.
Save connection string is settings of project properties.
Go in project properties.
Select settings.
Add new setting as connection string and save connection string.
Then you can use it for whole project.
The title almost says it all, but I'll provide a little background.
I am working on adding password hashing to a program written by a team member who rather suddenly departed this world. I have all of the original source, and have made appropriate changes.
The issue arises when, after looking at the active connections on the database, the connection it is making is under my Windows Activate Directory username, rather than the connection string I give to SqlConnection().
I am not traditionally a C# programmer, but the language is very easy to pick up on. For those more accustomed to C#'s particular ins and outs, what can I do to assure that I'm connecting through the connection string passed to SqlConnection()?
This is important since people who are not me and have no authorization to the database are not going to be able to even validate their DB stored usernames + password without using that connection string.
EDIT: My current connection string is as follows:
user id=[uid];password=[password];server=[server];Trusted_Connection=yes;database=[dbName];connection timeout=30"
Trusted_Connection is an alias for Integrated Security, which means "use my Windows account". Remove it from your connection string.
I have an encrypted password in a connection string, contained in a web.config file. I do not know what the password is, and thus cannot connect to my database.
I ran aspnet_regiis.exe -pdf against the web.config and received the following:
Decrypting configuration section...
Succeeded!
I guess I had assumed that the password would be displayed on the screen, or something close to that? Then I thought the program might create a log file with the information in it? Couldn't find one.
I know I am missing something fundamental, I just don't know what it is.
You cannot decrpty the encrypted password.
The whole point of encrypting the password is so that no one is able to decrpty and find what the password is unless you know the key.
When you encrypt the connection string, the key is automatically created and stored in the machine where the encryption was done.
So, if you copy the web.config file to some other machine and do the decryption using:
aspnet_regiis.exe –pdf “connectionStrings” YourPathToWebConfigFile
This won't work.
And to answer your question, if the encryption and decryption was done on the same machine, then your web config file will change automatically with the plain text (decrypted data) for connection string , not that the password would be displayed on the screen.
Run below command
aspnet_regiis.exe –pdf “connectionStrings” C:\inetpub\wwwroot\MyApplication
C:\inetpub\wwwroot\MyApplication needs to be the path where your web.config file is. Once you finish executing above command check your web.config file. If it worked OK you will have decrepted connection string section.
I am very new on c#/Visual Studio and I'm having difficulty on running my test methods. It requires us to connect to a database server resulting of getting always a failed result since we can't connect to the database.
We tried to modify the connection string to include our working credentials so that we can connect to the database server but the app.config file was encrypted.
Please see below screenshot of example encrypted line. How can we modify that?
As I see it I think the connectionstring is encrypted outside the project and pasted here. I am saying this because IMO encrypting just the connection string value and keeping the key in plain text is not possible from within the project. It is possible to encrypt the entire section within a config file.
Check the method which is using this connectionstring. I believe The method might be using some form of decryption. Use that to decrypt the string, change the values as required, encrypt it again and paste it in the above location.
You can also edit your question to include the method which is using the connectionstring so that I can analyse it and give you a better solution.
Hope this helps.
I created a desktop application in C#/WPF which connects to a SQL Server 2008 instance through a constant connection string specified in code as follows (for testing purposes):
private string GetConnectionString()
{
//test
return "Data Source=[server IP]; Initial Catalog=[database name]; User ID=[user ID]; Password=[smart password];";
}
The application will be used by various users and will be deployed via ClickOnce, a .zip archive or a custom installer. It also has a separated custom login functionality by requesting an application-access username and password.
Which is the best practice to store the connection string details for my desktop application (IP, database, SQL Server user, password)? If the connection string changes over night, which is the best method to update it without forcing users to update to the latest version of my application? Users should not be able to see/intercept/decompile the connection string, so I guess I must use some sort of encryption.
Do you have any kind of suggestion for my inquiry?
Even if you compile your connection strings into the application, they still can be viewed using the Ildasm.exe (MSIL Disassembler) tool because strings are a part of assembly's metadata.
Maybe this question can help you.
In a desktop application, you can't prevent a determined user from seeing the connection string. Even if you use encryption, a determined user will be able to find and use the encryption key.
If the client is connecting to the database then the connection can be hacked.
This is a sample of connection data in App.Config
<appSettings>
<add key="dbServer" value="svr"/>
<add key="dbDataBase" value="db1"/>
<add key="dbUser" value="sharedUser"/>
<add key="dbPassword" value="easyPassword"/>
</appSettings>
Need a reference to system.configuration
string SvrName = ConfigurationManager.AppSettings["dbServer"];
string DBName = ConfigurationManager.AppSettings["dbDataBase"];
string DBUser = ConfigurationManager.AppSettings["dbUser"];
string DBPassword = ConfigurationManager.AppSettings["dbPassword"];
As for security the answer is a 2 tier application where only the secure server side code connects to the database. This code sample from server side code.
The other benefits of server side is repeated queries from the same connection can gain from indexes in memory from prior query.
You could salt and hash the password read from the AppSettings and obsfuscate the application but you would have to use a static salt so it could be hacked. It would just slow down the hacker.
You need to add an "Application Settings" file to your application. Just right click on your solution -> add -> find something similar to "app configuration". In order to do this you will need some kind of external config file to store the connection string. You could even use a simple file. If worried about people finding the file, you can always encrypt the string and decrypt it in your app.
My opinion is that the safest solution is to have a local DNS entry point to the current SQL machine and the authentication to be Windows authentication.
For example : SQLMACHINE host name pointed to 192.168.1.3 in the DNS server.
This way if the name/IP of the SQL machine changes, only the DNS server needs updated (and possibly the local DNS caches to be invalidated).
Having Windows authentication means that no password will be stored on the local machine so you can safely store the connection string in the .config file with no worries.
My 2 (euro)cents.