Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Security / April 2007

Tip: Looking for answers? Try searching our database.

AspNet_RegIIS ...encrypting web.config when running Cassini

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Hey it's Filippo - 12 Apr 2007 00:34 GMT
ASP.NET 2.0
Windows app written in C# and VS 2005
=============================
I am having difficulties encryting web.config files when using Cassini (IIS is currenly disabled) as the VirtualDirectory param seems to only work when IIS is up and running.
The idea is that we want our windows app, that uses a browser component to run local sites, to work on OS that don't have IIS. So we need to embed Cassini in order to make it work.

And all works perfectly ...all but the call to encrypt the web.config.
I am trying 2 different techniques:
   1) Configuration object
       FileAttributes attr = FileAttributes.Archive | FileAttributes.Normal;
       File.SetAttributes(Constant.FolderWebsite + @"\Web.Config", attr);
       Configuration config = WebConfigurationManager.OpenWebConfiguration("/MyWebSiteVirtualDir");
       ConnectionStringsSection section = config.GetSection("connectionStrings") as ConnectionStringsSection;
       if (section.SectionInformation.IsProtected == false)
           section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
       config.Save();

   2) Run a command using AspNet_RegIIS
       string param = "-pe \"connectionStrings\" -app \"/MyWebSiteVirtualDir\" -prov \"DataProtectionConfigurationProvider\"";
       Process myProcess = new Process();
       object o = new object();
       myProcess.StartInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
       myProcess.StartInfo.CreateNoWindow = true;
       myProcess.StartInfo.FileName = "aspnet_regiis";
       myProcess.StartInfo.WorkingDirectory = Path.GetDirectoryName(o.GetType().Assembly.Location);
       myProcess.StartInfo.Arguments = param;
       myProcess.Start();
       myProcess.WaitForExit();
       myProcess.Close();

Both techniques work when IIS is up and running because it returns the physical path of the MyWebSiteVirtualDir.

QUESTION
How can I make this working when IIS is not present?
Is there a different way to encrypt a web config without having the need of IIS?

Thanks,
Filippo
Dominick Baier - 12 Apr 2007 05:54 GMT
for the command line use -pef.

for the API - create a Map (have a look at the overloads of OpenWebConfiguration)
- this allows to map vdirs to physical dirs.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

> ASP.NET 2.0
>
[quoted text clipped - 51 lines]
> Thanks,
> Filippo
Hey it's Filippo - 12 Apr 2007 21:17 GMT
Thanks Dominick !!!

SOLUTION
============================================================
FileAttributes attr = FileAttributes.Archive | FileAttributes.Normal;
File.SetAttributes(Constant.FolderWebsite + @"\Web.Config", attr);
WebConfigurationFileMap fileMap = new WebConfigurationFileMap();
VirtualDirectoryMapping vDir  = new
VirtualDirectoryMapping(Constant.FolderWebsite, false);
fileMap.VirtualDirectories.Add(Constant.IISOfflineVirtualPath, vDir);

Configuration config =
WebConfigurationManager.OpenMappedWebConfiguration(fileMap,
Constant.IISOfflineVirtualPath);

ConnectionStringsSection section = config.GetSection("connectionStrings") as
ConnectionStringsSection;

if (section.SectionInformation.IsProtected == false)
    section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");

// ** To Unprotected
// section.SectionInformation.UnprotectSection();

config.Save();

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.