Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot
 
PerlMonks  

Re^2: Where should I have configuration information in a file or database

by afoken (Parson)
on May 30, 2009 at 23:10 UTC ( #767084=note: print w/ replies, xml ) Need Help??


in reply to Re: Where should I have configuration information in a file or database
in thread Where should I have configuration information in a file or database

sections in the config file to store sensitive content that must be encrypted ie the connection string and must be decrypted by the application.

This may give you a warm fuzzy feeling that you have used encryption and so everything simply just must be safe.

But this is just a little annoyance for anyone trying to get the data: The application must contain the decryption code, and it must contain the decryption key. Both can be extracted, and with the addition of a few simple print statements, you can see the "protected" information in plain text. If the decryption code is burried in the runtime environment, things become even easier for an attacker: Just find the key, call the runtime environment's decryption routine in your own ten line script, and print what it returns when processing the "protected" information.

Oh, and I almost forgot: How does it help to encrypt information in a config file that are afterwards transmitted in clear through the network, e.g. when connecting to a MySQL or FTP server?

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)


Comment on Re^2: Where should I have configuration information in a file or database
Re^3: Where should I have configuration information in a file or database
by nikosv (Hermit) on Jun 01, 2009 at 09:17 UTC
    Ok,I have to elaborate more :
    You create a key container. There are machine-level and user-level containers
    Specify a protected configuration provider (RsaProtectedConfigurationProvider or DataProtectionConfigurationProvider) which essentially is a class that you can use from your code.

    Pass the provider your key container (in case of RSA,in case of DPAPI is simpler) and when saving the configuration file the <protectedData> sections will be encrypted.
    The decryption key is not included in the configuaration file or the application.
    e.g. in the case of DataProtectionConfigurationProvider the decryption key is auto-generated and saved in the Windows Local Security Authority.

    When calling the application the .net framework will decrypt the connection string and makes it available to your application. You don't have to write any code to encrypt or decrypt.
    Of cource if the memory of the application is compromised, the sensitive information might get compromised as well.

    "How does it help to encrypt information in a config file that are afterwards transmitted in clear through the network, e.g. when connecting to a MySQL or FTP server?"
    well the original question was "Where should I have configuration information in a file or database, on the basis of security and accessibility",
    did not ask anything about securely transmitting the connection string, but in case you are curious you might want to look at Secure connection to SQL Server from Perl DBI

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://767084]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others imbibing at the Monastery: (9)
As of 2014-09-20 14:13 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    How do you remember the number of days in each month?











    Results (159 votes), past polls