Web. config local encryption and decryption BAT

Comments: Some users cannot use aspnet_regiis-pdf to decrypt the configuration file even if they log on to the server. Open the SDK command prompt that comes with. Net Framework.
Encryption command:
Aspnet_regiis-pe "connectionStrings"-app "/encrypttest"
-The pe switch is used to specify the section to be encrypted in web. config (connectionStrings configuration section in the Web. Config file ).
-The app switch is used to specify the virtual directory in IIS. If it is the root directory website, it is "/".
Decryption command:
Aspnet_regiis-pd "connectionStrings"-app "/encrypttest"
The only difference is that we use the-pd switch instead of the-pe switch.
1. Encrypt EncryptWebConfig. bat
@ Echo off
C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ aspnet_regiis.exe-examples "connectionStrings" "D: \ Program Files \ Microsoft. NET \ Pet Shop 4.0Web"
PAUSE
2. decrypt DecryptWebConfig. bat
@ Echo off
C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ aspnet_regiis.exe-pdf "connectionStrings" "D: \ Program Files \ Microsoft. NET \ Pet Shop 4.0Web"
PAUSE
Solution:
Run in dos:
Aspnet_regiis-pa "NetFrameworkConfigurationKey" "nt authority \ network service"
If an error occurs, put the directory C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 in the path environment variable.
Then you can access the website successfully.
You can also use the command line to implement "RSAProtectedConfigurationProvider" encryption.
Now, attach the found file to the following:
If you want to encrypt the database connection string of web. config, two methods are provided here.
Method 1,
Use "DataProtectionConfigurationProvider" to create the tmdsb. aspx file. The Code is as follows:
Add reference
Using System. Web. Configuration;
Using System. IO;
// Encryption
Protected void button#click (object sender, EventArgs e)
{
Configuration config = WebConfigurationManager. OpenWebConfiguration (Request. ApplicationPath );
ConfigurationSection section = config. GetSection ("connectionStrings ");
If (section! = Null &&! Section. SectionInformation. IsProtected)
{
Section. SectionInformation. ProtectSection ("DataProtectionConfigurationProvider ");
Config. Save ();
}
}
// Decrypt
Protected void Button2_Click (object sender, EventArgs e)
{
Configuration config = WebConfigurationManager. OpenWebConfiguration (Request. ApplicationPath );
ConfigurationSection section = config. GetSection ("connectionStrings ");
If (section! = Null & section. SectionInformation. IsProtected)
{
Section. SectionInformation. UnprotectSection ();
Config. Save ();
}
}
Conclusion: This method is convenient and simple, but the security is not highly secure.
Method 2,
Use the "RSAProtectedConfigurationProvider" format for encryption
The test. aspx program file is basically the same as above,
Set
Section. SectionInformation. ProtectSection ("DataProtectionConfigurationProvider ");
Change
Section. SectionInformation. ProtectSection ("RSAProtectedConfigurationProvider ");
However, when you visit the website, it is very likely that
Note:
An error occurred while processing the configuration file required to provide services to the request. Check the following error details and modify the configuration file as appropriate.
Analyzer error message: the provider "RsaProtectedConfigurationProvider" cannot be used for decryption.
The error message returned by the provider is: the RSA key container cannot be opened.
The solution to this error is:
Run in dos: aspnet_regiis-pa "NetFrameworkConfigurationKey"
"Nt authority \ network service"
If an error occurs, set the directory C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727.
Put it in the environment variable path. Then you can access the website successfully.
You can also use the command line to implement "RSAProtectedConfigurationProvider" encryption.
Note: You can also choose not to run the aspnet_regiis-pa "NetFrameworkConfigurationKey"
Run the "nt authority \ network service" command to register the default
RsaProtectedConfigurationProvider's RSA key container
The method is as follows:
1) Create an exported rsa Key container named Key
Aspnet_regiis-pc "Key"-exp
2) specify the key container before the information you want to encrypt, such:
<ConfigProtectedData>
<Providers>
<Clear/>
<Add name = "KeyProvider"
Type = "System. Configuration. RsaProtectedConfigurationProvider, System. Configuration, Version = 2.0.0.0, Culture = neutral, PublicKeyToken = b03f5f7f11d50a3a, processorArchitecture = MSIL"
KeyContainerName = "Key"
UseMachineContainer = "true"/>
</Providers>
</ConfigProtectedData>
<ConnectionStrings>
<Add name = "SQLConnString" connectionString = "Data Source = yourIP; Initial Catalog = test; User Id = yourID; Password = yourPassword ;"
ProviderName = "System. Data. SqlClient"/>
</ConnectionStrings>
Make sure that the xmlns attribute in configuration has the following values:
3) encrypt the configuration file
Aspnet_regiis-FFE "connectionStrings" "E: \ project \ Test"-prov "KeyProvider"
The parameters are: configuration section to be encrypted, physical path of the project directory, and secret key container name used for encryption.
Looking at the web. config file, you will find that the connectionStrings section has been encrypted,
Running the program will find that the program can still access the database correctly.
In this case, you only need to run:
Aspnet_regiis-pdf "connectionStrings" "E: \ project \ Test"
You can decrypt the web. config file.
(Note: if there is still an error, it may be that you do not have sufficient permissions for the generated key file,
Go to C: \ Documents ents and Settings \ All Users \ Application Data \ Microsoft \ Crypto \ RSA \ MachineKeys
Directory, find the generated key file, and grant the read permission of the network service user to it,
You can also run the following command: aspnet_regiis-pa "Key" "nt authority \ network service ",
You may need to restart iis
4) export the key container as an xml file
Aspnet_regiis-px "Key" "e: \ Key. xml"
This command only exports the public key, so it can only be used for encryption and cannot be decrypted later.
Aspnet_regiis-px "Key" "e: \ Keys. xml"-pri
The private key is exported together, so we need to use this.
5) Delete the key container
Aspnet_regiis-pz "Key"
After the program is deleted, an error occurs:
Analyzer error message: failed to use the provider "KeyProvider" for decryption.
The error message returned by the provider is: the RSA key container cannot be opened.
Likewise, it can prove that, on any machine that does not have the correct Key container Key installed,
The program cannot decrypt the connectionStrings section, so it cannot run normally.
6) import the key. xml file
Aspnet_regiis-pi "Key" "e: \ Keys. xml"
Then, run the program and you will find that it can be decrypted again. This proves that the encryption and decryption mechanism works properly.
Finally, let's talk about the security protection provided by this mechanism in what aspects:
It is not significant to encrypt the app. config of the winform program because,
Clients can decrypt the configuration file by running aspnet_regiis-pdf to expose sensitive information.
The significance of web. config encryption is limited to: when the web. config file is accidentally leaked,
No sensitive information is exposed at the same time. If a malicious attacker has obtained the permission to run the program on the server,
Like app. config, you can easily obtain plain text by running aspnet_regiis-pdf.
Also, via aspnet_regiis-pa "Key" "nt authority \ network service"
Control access permissions to key containers of different users. Further security measures should be available,
For example, some users cannot use aspnet_regiis-pdf to decrypt the configuration file even if they log on to the server.