Managing DB Access Passwords in a .NET Application?

Question

So I've been tasked with modernizing a .NET application built in Visual Studio that functions as my organization's receipt matching tool. One of the problems that sticks out the most is that it stores its passwords for non-prod AND prod database access in an app.config file, unencrypted and part of the source code stored in TFS. The connection strings look similar to this:

 <!-- DEV -->
<add name="DEV_USER" connectionString="data source=DEVDB;user id=DEV_USER;password=*Password*;" providerName="System.Data.OracleClient"/>

Any suggestions on how to manage these outside of the application while still using them within? I am also fairly new to .NET applications, so any advice is greatly appreciated.

score 0 · Answer 1 · answered Feb 22 '19 at 15:46

0

If you don't want to store any passwords you can populate them at runtime:

 <add name="DEV_USER" connectionString=" ..SNIP.. password={0};" ..SNIP.. />

Then use string.Format(devConnectionString, realPassword)

answered Feb 22 '19 at 15:46

Zer0

7,191
1
20
34

score 0 · Answer 2 · answered Feb 22 '19 at 16:01

You can use external file to hold connectionstrings for example:

Databases.xml

with encrypted content like this:

<?xml version="1.0" encoding="utf-8" ?>
<DATABASES>  
    <DataBase ConnStr="CKS27/1dfdsUJd3eKfdjvwxGUFGMtFKOWVv1FgffhGQ1uZGWk/PuPCogfOvWsYhdMWKQSfdtxg==">DBName</DataBase>  
    </DATABASES>

and use them when your code starts execution. Within that external file you can hold those connectionstrings in encrypted way and decrypt them when you need. Linq, EF and SqlConnection all support setting of ConnectionStrings from code.

For example:

doc = new XmlDocument();
            string fullFileName = System.Environment.CurrentDirectory + @"\" + "Databases.xml";
            doc.Load(fullFileName);
foreach (XmlNode node in doc.DocumentElement.ChildNodes)
            {
                if (node.InnerText == DBName)
                {
                    string currConnStr = Decrypt(node.Attributes["ConnStr"].Value);
                    return currConnStr;
                }
            }

But you should be aware that everybody can write a small application which calls `Decrypt(...)` on this encrypted string. Also note `Encrypt()` is linked to the user, i.e. if you encrypt the password with your user account then you cannot use it on any other machine with a different user. — Wernfried Domscheit, Feb 22 '19 at 16:15

Managing DB Access Passwords in a .NET Application?

2 Answers2