Search code examples
c#vb.netsecurityencryptionpassword-protection

How to save SQL server password

We have an application running multiple services and executables. Some one them need to access the SQL database, so I need to store the SQL server password somewhere. To avoid direct access to the password, the password is stored encrypted. To decrypt the string, a crypto DLL can be called, returning the plaintext password. Whats bothering me is, how to avoid that anyone can decrypt the password. The following options had been discussed and discarded, because they do not solve the problem of more or less direct access to the plaintext password:

  1. The crypto dll contains all required information to decrypt the password: any malicous user may call the DLL to decrypt the password with his own component

  2. Using DPAPI, I need to set the scope to LocalMachine, meaning any user logging on to the local system may decrypt the password.

2a. Using DPAPI and a service component running with special account would solve the "any local user can use the Unprotect method of DPAPI to decrypt the password" problem, however, the malicous user still can call the crypto service with his own component.

  1. The crypto DLL requests a password, and encrypts/decrypts using a RijndaelManaged instance. Every calling DLL must know the password, meaning I just moved the problem to another component.

  2. Integrated Security is not an option, customer's security policies deny to use IS

Any pointer how to solve this?

Solution

  • This will depend how far you think a user in the system will go to get at the connection string.

    • Do they need domain access to use your application?
    • Can you restrict IP addresses into your SQL server?
    • Do users have admin rights on their machines?
    • e.t.c.

    Things like the above will narrow down the potential users that can gain access. Some other things that seem to stand out are:

    • Move the KEY and IV outside the DLL as that seems to be the single point of failure if its stolen
    • Obfuscate the key and iv in your application code or store in certificates, possibly with DPAPI
    • Lock down access to your program files, make the application run under a restricted user.

    Some other tips are here:

    handling key and iv values
    storing key in certicates
    restrict SQL access by IP address