Secure your web.config by encrypting important tags

Introduction

Welcome again to a new security article, where we will discuss and demonstrate how to secure our web.config important tags, like Impersonation.
it's username and password.
in this article we will see how to secure Impersonate tags in web.config ?

What is impersonation ?

Before securing impersonation tags in web.config, we will see what is impersonation.
Basically impersonation is fall under Authorization concept, Authorization is the process of determining the rights of the authenticated user
Impersonation is the technique in which the logged user behave like an authenticated entity. Infact, the Impersonation is not enabled initially but
We can set the impersonation in web.config file

In web.config we can set impersonation tags under , we can provide a username and password to the impersonation.


[System.WEB]
	[identity impersonate="true" userName="Administrator" password="PASS"/]
[/System.WEB]

here is web.config

web.config

How to secure Web.Config?

Now the problem comes when i impersonate web.config and if anyone open my web.config with Plain text, Then one can easily
see my password as it's in a plain text. and can hack my user account.
I have seen lot of web.config with plain text impersonation tags.
we can secure web.config tags with encryption standards.
here we are using RSA data encryption standard.
To encrypt a web.config tags, follow following process

1. Go to server where you have deployed your web application

2. Open Command Prompt, and navigate to Framework folder in windows folder.

Command_prompt

3.Now fire the below command to make web.config Tag encrypted., The command is

  
aspnet_Regiis -pef system.web/identity [Physical Path of website]

Encrypt_command

here ,
aspnet_regiis: is a executable configuration file which will help IIS and ASP.NET to configure different configuration settings.
-pef: Encrypt given web.config key
system.web/identity: Tag in web.config to which we want to apply encryption

4. After typing given command in command prompt hit enter. System will execute given command and encrypt
data successfully

encrypt_success

5. After opening given web.config file you can see that, your web.config is encrypted now.

encrypt_config

6. Here we have encrypt web.config using RSA encryption standard. all encrypted keys are stored at RSA folder where RSA folder exist in
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto

RSA

7. To write a encrypted key we have write access to this folder so we can provide some access to given folder, by executing following command


aspnet_regiis -pa "NetFrameworkConfigurationKey" "NT Authority\Network Service"

-pa: Give access to particular access RSA key
NetFrameworkConfigurationKey configuration key name
NT Authority\Network Service: User/group name to which we have to give access to folder

access_success

8. Now we can browse the site and can check, is it running properly or not.

How to Decrypt Web.Config?

you can decrypt web.config file which is already encrypted. here is the command


aspnet_Regiis -pdf system.web/identity [Physical Path of website]

aspnet_regiis: is a executable configuration file which will help IIS and ASP.NET to configure different configuration settings.
-pdf: Decrypt given web.config key
system.web/identity: Tag in web.config to which we want decryption

Decrypt_command

Likewise we can encrypt any section in web.config by the help of above encryption command and Configuration executable file.
we will learn more about ASPNET_REGIIS.EXE in my upcoming article.

Thanks
Thanks for giving your valuable time for this article,
Suggestion are most welcome.

Thanks
koolprasad2003

Secure your web.config by encryption

Secure your web.config by encrypting important tags

Introduction

What is impersonation ?

How to secure Web.Config?

How to Decrypt Web.Config?

Post Comment: