In May we posted our Blog on Alerting For Best Practice Encryption, outlining how Passwordstate offers a Defense-in-Depth option for encrypting your configuration files, and now alerts on configuration files used by Passwordstate that have not yet been encrypted.
For details related to this article please see https://blog.clickstudios.com.au/alerting-for-best-practice-encryption/
But how are configuration files encrypted and what is the application responsible for the encryption. This week’s blog fills in the gaps.
Using Built-In Functionality
When you install Passwordstate, one of the system requirements is .NET Framework 4.7.2 (or higher). This provides the tools and libraries required for web applications, including an application called aspnet_regiis.exe.
This application is used to encrypt or decrypt sections of a Web configuration file. The ASP.NET framework automatically decrypts encrypted configuration elements in your Web.config file when it is loaded into memory for use by the website.
The encryption of configuration elements is referred to as protected configuration and it ensures highly sensitive information is not stored in a readable or decodable format. This improves security by making it difficult for an attacker to gain access to that sensitive information, including usernames, passwords, database connection strings and encryption keys, even if they gain access to the file or the associated database etc.
when encrypted, the configuration elements can only be decrypted on the server responsible for the original encryption. They cannot be decrypted on any other system.
Please note, if the memory for your application is compromised, the sensitive information from your protected configuration section might be compromised as well. This is not a vulnerability associated with Passwordstate, rather a potential weakness in your Defense-in-Depth approach.
How to Encrypt Your Protected Configuration
We’ve produced a manual showing how to encrypt (and decrypt) the protected configuration elements in your web.config file. This includes the relevant configuration elements for the following;
- Primary Passwordstate website
- High Availability Passwordstate website
- Password Reset Portal
- AppServer Module
- Remote Site Locations Agents
- Self Destruct Web Site (Push/Pull implementation)
The manual can be found under the documentation section of our website here https://www.clickstudios.com.au/downloads/version9/Encrypt_Passwordstate_Config_Files.pdf
We encourage customers to reference the Encrypt Passwordstate Configuration Files manual. This will provide guidance of which configuration elements require encryption.
Encrypting… an Example
This example is based on encrypting the two configuration elements used with your Primary Passwordstate instance. These are connectionStrings and appSettings.
On your Passwordstate Web Server open a Command Prompt with administrator privileges and navigate to C:\Windows\Microsoft.NET\Framework64\v4.0.30319
Now type in aspnet_regiis.exe -pef “connectionStrings” “c:\inetpub\passwordstate” and press enter. Note that if you installed Passwordstate in a different location you’ll need to replace c:\inetpub\passwordstate with the location of your Passwordstate instance. You should see the following;
Now you should proceed to encrypt the appSettings section of your Web.config file.
Type in aspnet_regiis.exe -pef “appSettings” “c:\inetpub\passwordstate” and press enter. Again, if you installed Passwordstate in a different location you’ll need to replace c:\inetpub\passwordstate with the location of your Passwordstate instance. Your screen should look similar to the one below;
Now that you’ve successfully encrypted your Database Connection String and AppSettings, you’ll need to restart your Passwordstate Windows Service. To do this you can enter the following commands;
net stop “Passwordstate Service”, and,
net start “Passwordstate Service”
You should be presented with the following after running each command.
You can now exit out of command prompt.
Decrypting… an Example
This example is based on decrypting the two configuration elements used with your Primary Passwordstate instance. These are connectionStrings and appSettings.
On your Passwordstate Web Server open a Command Prompt with administrator privileges and navigate to C:\Windows\Microsoft.NET\Framework64\v4.0.30319.
Again note, if you installed Passwordstate in a different location you’ll need to replace c:\inetpub\passwordstate with the location of your Passwordstate instance.
Now type in aspnet_regiis.exe -pdf “connectionStrings” “c:\inetpub\passwordstate” to decrypt the connectionStringssection and press enter. Once this is completed then type in aspnet_regiis.exe -pdf “appSettings” “c:\inetpub\passwordstate” to decrypt the appSettings section and press enter. You should be presented with the following after running each command.
You’ll also notice in the image above we’ve stopped and started the Passwordstate Service.