blocks|key|1196665|text|Rahul，将字符串从ASCII转换为base64字符串并不是加密，正如你的第一个链接所暗示的那样。我们可以很容易地将base64转换成ASCII码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1196666|将configsection.protectSection()与RSA一起使用是适用于Web.config文件各部分的正确加密方法。|1196667|请查看此链接：http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx|offset|length|1196668|请注意，我们不能在信任级别设置为中等信任的共享主机环境中加密Web.config文件。|1196669|entityMap|0|LINK|mutability|MUTABLE|url|http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx^0|0|0|7|27|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$F|U|G|V|1|W]]|A|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

Rahul, converting a string from ASCII to base64 string isn't an encryption, which is what your first link suggests. We can easily convert base64 to ASCII. 

Using configsection.protectSection() with an RSA key is a proper encryption that is available for sections of the Web.config file.

Check this link: <a href="http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx" rel="noreferrer">http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx</a>

Please note, that we can not encrypt Web.config file in a shared hosting environment where Trust level is set to medium trust.

blocks|key|1411983|text|要避免访问外部链接，请访问C:\Windows\Microsoft.NET\Framework\v4.0.30319+(适用于.NET+4/+4.5)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1411984|aspnet_regiis.exe+-pe+"connectionStrings"+-app+"/YourWebSiteName"+-prov+"DataProtectionConfigurationProvider"|code-block|syntax|javascript|1411985|要使用此工具解密connectionStrings段，可以在aspnet_iisreg.exe工具中指定以下命令。|1411986|aspnet_regiis.exe+-pd+"connectionStrings"+-app+"/YouWebSiteName"|1411987|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

To save having to visit external links, in C:\Windows\Microsoft.NET\Framework\v4.0.30319 (for .NET 4 / 4.5)

<pre><code>aspnet_regiis.exe -pe "connectionStrings" -app "/YourWebSiteName" -prov "DataProtectionConfigurationProvider"
</code></pre>

To decrypt connectionStrings section using this tool, you can specify following command in aspnet_iisreg.exe tool.

<pre><code>aspnet_regiis.exe -pd "connectionStrings" -app "/YouWebSiteName"
</code></pre>

blocks|key|1411875|text|使用aspnet_regiis.exe+http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1411876|http://msdn.microsoft.com/en-us/library/system.configuration.sectioninformation.protectsection.aspx|1411877|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx|1^0|K|1H|0|0|0|2R|1|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]]|C|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|F|3|-4|5|6|7|W|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|E]]]]

use aspnet_regiis.exe 
<a href="http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx</a>

<a href="http://msdn.microsoft.com/en-us/library/system.configuration.sectioninformation.protectsection.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/system.configuration.sectioninformation.protectsection.aspx</a>

blocks|key|1196783|text|在命令中运行此命令:+aspnet_regiis.exe+-pef+"connectionStrings“"pathToWebConfig”|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1196784|或者，如果您希望它以编程方式运行，您可以创建一个进程：|1196785|++++++++++++string+fileName+=+@"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe";

++++++++++++if+(8+==+IntPtr.Size
++++++++++++++++%7C%7C+(!string.IsNullOrEmpty(Environment.GetEnvironmentVariable("PROCESSOR_ARCHITEW6432"))))
++++++++++++fileName+=+@"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe";

++++++++++++string+arguments+=+$"-pef+\"connectionStrings\"+\"{application.Path}\"";

++++++++++++using+(Process+process+=+new+Process())
++++++++++++{
++++++++++++++++process.EnableRaisingEvents+=+true;
++++++++++++++++process.StartInfo+=+new+ProcessStartInfo
++++++++++++++++{
++++++++++++++++++++FileName+=+exeName,
++++++++++++++++++++Arguments+=+arguments,
++++++++++++++++++++UseShellExecute+=+false,
++++++++++++++++++++RedirectStandardOutput+=+true,
++++++++++++++++++++RedirectStandardError+=+true,
++++++++++++++++++++CreateNoWindow+=+true
++++++++++++++++};

++++++++++++++++process.Start();
++++++++++++++++processOutput.Output+=+process.StandardOutput.ReadToEnd();
++++++++++++++++bool+exited+=+process.WaitForExit(timeoutMilliseconds);
++++++++++++++++if+(exited)
++++++++++++++++{
++++++++++++++++++++processOutput.ExitCode+=+process.ExitCode;
++++++++++++++++}
++++++++++++}|code-block|syntax|javascript|1196786|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Run this in Command :
aspnet_regiis.exe -pef "connectionStrings" "pathToWebConfig"

or , if you want this to run programatically you can create a Process :

<pre><code> string fileName = @"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe";

 if (8 == IntPtr.Size
 || (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable("PROCESSOR_ARCHITEW6432"))))
 fileName = @"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe";

 string arguments = $"-pef \"connectionStrings\" \"{application.Path}\"";

 using (Process process = new Process())
 {
 process.EnableRaisingEvents = true;
 process.StartInfo = new ProcessStartInfo
 {
 FileName = exeName,
 Arguments = arguments,
 UseShellExecute = false,
 RedirectStandardOutput = true,
 RedirectStandardError = true,
 CreateNoWindow = true
 };

 process.Start();
 processOutput.Output = process.StandardOutput.ReadToEnd();
 bool exited = process.WaitForExit(timeoutMilliseconds);
 if (exited)
 {
 processOutput.ExitCode = process.ExitCode;
 }
 }
</code></pre>

blocks|key|1412115|text|ASPNET_REGIIS，正如其他人所说的那样。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1412116|但请记住，当考虑到编码的强度和要求时，RSA并不是万无一失的，甚至不是很强。打破它只需要几分钟。|1412117|我的情况是，我必须使用SQL+server身份验证连接到其中一个SQL+server，而SQL+server身份验证又要求在连接字符串中以纯文本形式写入密码。|1412118|文件中的明文密码是错误的。更好的RSA编码。因此，当有人查看它，但并不真正想要破解它时，他看不到密码。|1412119|但是，它位于只能从域内访问的服务器上，这将可能的攻击者限制在100以下，其他任何人都必须首先进入域，如果发生这种情况，连接到测试环境DB服务器是最小的问题。此外，在这100个人中，只有大约5个人拥有管理员权限，这使他们有权使用ASPNET_REGIIS彻底解密文件。|1412120|不管怎样，你必须相信这些。对于所有其他人来说，他们可以获得的数据的价值远远低于他们必须投入的工作。冒着失去雇员的风险也是不值得的。|1412121|而且，他们甚至不知道这个东西是可能被破解的。现在，即使他们以某种方式发现了这一点，他们也不会在没有任何工作的情况下获得明文密码。|1412122|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|S|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|U|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|V|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|O|$]]

ASPNET_REGIIS, as said by others. 

But remember when considering strength and requirements of encoding, RSA is not fool-proof, not even very strong. Breaking it takes minutes. 

My case is, I must connect to one of the SQL servers using SQL server authentication, which in turn requires to write the password in plain text in the connection string. 

Plain text passwords in files are just wrong. Better RSA encoded. So when someone looks at it and does not really want to break into it, he does not see the password. 

However, it is on a server only accessible from within the domain, which limits the possible attackers to less than 100, anyone else would have to break in the domain first, and if that happens connecting to a test environment DB server is the least of the problems. Also, out of those 100 people, only about 5 have the admin privileges, which give the right to cleanly decrypt the file using ASPNET_REGIIS. 

You have to trust those anyway. For all the others, the value of data they could get is much less than the work they would have to put in getting it. It is not worth the risk of ceasing to be employees either. 

Also, they mostly don't even know about this thing being possible to break into. And now, even if they somehow find out, they don't get a plain text password without any work.

问加密web.config中的连接字符串
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问加密web.config中的连接字符串EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问加密web.config中的连接字符串
EN