I just found that we can see the database connection string in plain text
via the IIS ASP.NET configuration even the connection string is encrypted in
web.config file. Is this a security hole?

On Mar 31, 10:31=A0pm, "Ricky Chan" <ricky.chan.n... [at] live.com> wrote:
> I just found that we can see the database connection string in plain text
> via the IIS ASP.NET configuration even the connection string is encrypted =
in
> web.config file. Is this a security hole?


No, it is not a security hole.

web.config encryption is meant as a defense against someone stealing
the web.config file.

The encryption is not meant as a way to secure a string such that only
IIS can read it and bypassing the application layer in the middle.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Is there any way to block someone who acts as a system administrator role
but not allowed to read the configuration in config file?



"David Wang" <w3.4you [at] gmail.com> wrote in message
news:75c4be79-0c80-4709-98e3-1b5adad5f4a4 [at] c19g2000prf.google groups.com...
> On Mar 31, 10:31 pm, "Ricky Chan" <ricky.chan.n... [at] live.com> wrote:
>> I just found that we can see the database connection string in plain text
>> via the IIS ASP.NET configuration even the connection string is encrypted
>> in
>> web.config file. Is this a security hole?
>
>
> No, it is not a security hole.
>
> web.config encryption is meant as a defense against someone stealing
> the web.config file.
>
> The encryption is not meant as a way to secure a string such that only
> IIS can read it and bypassing the application layer in the middle.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //

Not really. You have conflicting role and behavior expectations. You
will have to reconcile them.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//


On Apr 1, 6:23=A0pm, "Ricky Chan" <ricky.chan.n... [at] live.com> wrote:
> Is there any way to block someone who acts as a system administrator role
> but not allowed to read the configuration in config file?
>
> "David Wang" <w3.4... [at] gmail.com> wrote in message
>
> news:75c4be79-0c80-4709-98e3-1b5adad5f4a4 [at] c19g2000prf.google groups.com...
>
>
>
> > On Mar 31, 10:31 pm, "Ricky Chan" <ricky.chan.n... [at] live.com> wrote:
> >> I just found that we can see the database connection string in plain te=
xt
> >> via the IIS ASP.NET configuration even the connection string is encrypt=
ed
> >> in
> >> web.config file. Is this a security hole?
>
> > No, it is not a security hole.
>
> > web.config encryption is meant as a defense against someone stealing
> > the web.config file.
>
> > The encryption is not meant as a way to secure a string such that only
> > IIS can read it and bypassing the application layer in the middle.
>
> > //David
> >http://w3-4u.blogspot.com
> >http://blogs.msdn.com/David.Wang
> > //- Hide quoted text -
>
> - Show quoted text -