向 Windows 服务发送密码
向 Windows 服务发送密码的最佳方式是什么？ 我们的应用程序需要密码才能启动。 我不在乎服务“正常”应该在没有用户交互的情况下运行。 对于我们来说，操作员可以启动应用程序然后注销就足够了。
在 UNIX 系统上，我只需通过标准输入回显密码，但该服务没有标准输入。
目前，我们使用 DPAPI 仅使用 CryptProtectData 来存储密码。 虽然这有效，但它也带来了其他问题，这些问题开始变得麻烦。
我猜测我需要在服务和发送密码的应用程序之间使用某种形式的 IPC，但我不确定哪种方法合适（如果有）。
谢谢
What is the best way to send a password to a Windows Service? Our application needs a password in order to start. I don't care that services are "normally" supposed to run without user interaction. Its good enough for us that an operator can start the application and then log off.
On a unix system, I would just echo the password over stdin but the service has no stdin.
Currently, we use the DPAPI to just store the password using CryptProtectData. While this, works, it presents other problems that are beginning to become troublesome.
I'm guessing that I'll need to use some form of IPC between the service and the application that is sending the password but I'm not sure which method is appropriate, if any.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
两个主要选项：
您可以在启动时侦听套接字并等待提供所需的密码（也许在其中嵌入 SSH 服务器，以便密码无法通过网络窥探）
我的首选选项是读取密码来自配置文件（可以保护到最低限度的读者）或注册表设置（同样，足够安全，以便只有您的服务和管理员可以读取/更改它）
Two main options:
You could listen on a socket on startup and wait for the required password to be supplied (maybe embed an SSH server in there, so that the password cannot be snooped over the wire)
My preferred option would be to read the password from a configuration file (that can be secured to the minimum readership) or registry setting (again, sufficiently secure such that only your service and administrators can read/change it)
感谢您回复罗兰。
我考虑过这一点，但如果没有证书验证，这不会让我们容易受到中间人攻击吗？
我们试图尽可能遵循“深度防御”，这样如果攻击者破坏了机器，他将无法访问我们的应用程序。
Thanks for responding Rowland.
I considered that but without certificate verification, wouldn't that leave us open to a man in the middle attack?
We're trying to follow "defense in depth" as much as possible such that if an attacker compromised the machine, he would not able to access our application.
您可以使用 kerberos 相互身份验证。 那里的选项和示例很少。
但只是想知道。 在受感染的机器上，可能有一个键盘记录器。 因此，如果您想在此环境中保持安全，那么输入密码永远不会安全。 UNIX 终端也存在同样的问题。
You can use kerberos mutual authentication. There are few options and examples there.
But just wondering. On a compromised machine, There may be a key logger. So typing the password is never secure if you want to maintain security in this environment. The same problem exist afaik for unix terminals.
用户模式下的 DPAPI 确实是最佳选择，并将加密数据存储在受保护的位置，例如具有有限 ACL 的注册表项。
到底是什么问题开始变得麻烦呢？ 也许我们可以解决这些问题...
DPAPI in UserMode is really the best option, and storing the encrypted data in a protected location, e.g. registry key with limited ACL.
What exactly were the problems that are beginning to be troublesome? Maybe we can just solve those...
目前，该应用程序以本地系统帐户运行。
我们的应用程序将许多凭据存储在加密文件中，并使用 DPAPI（在用户模式下）进行加密。
因此，当安装应用程序时，安装程序将作为本地系统帐户运行。 我们还有一组随应用程序附带的工具，其中一些工具需要访问此加密文件，因此它们也需要作为本地系统帐户运行。
当应用程序安装并启动时，我们严重依赖该帐户。
我们遇到了问题，因为我们的一位用户想要使用该应用程序访问共享网络驱动器。 本地系统帐户没有此类权限，我们不能简单地以其他用户身份运行我们的服务，因为我们的加密信息受到本地系统帐户的保护。
我们试图避免仅为我们的应用程序设置用户帐户的过程，因为它安装在许多不同的客户和环境中，所有这些客户和环境都有截然不同的安全策略。
Currently, the application runs as the Local System account.
Our application stores a number of credentials in an encrypted file and uses the DPAPI (in UserMode) for the encryption.
Thus, when the application is installed, the installer is run as the Local System account. We also have a set of tools that ship with the application, some of which need access to this encrypted file and thus, they too need to run as the Local System account.
By the time the application is installed and started, we're heavily dependent on that account.
We're running into problems because one of our users wants to use the application to access a shared network drive. The Local System account has no such privileges and we can't simply run our service as a different user because our encrypted information is protected under the Local System Account.
We've tried to avoid the process of setting up a user account just for our application because it is installed across many different customers and environments, all of whom have wildly different security policies.
您可以从系统帐户下运行的服务访问远程驱动器。 但是，您需要拥有凭据和信息。 共享信息以连接到远程计算机。 您可以使用 API wnetaddconnection 来获取访问权限。 也许您的加密文件也可以存储此凭据。
You can access a remote drive from a service running under system account. However, you will need to have credentials & share information to connect to the remote machine. You can use the API wnetaddconnection to gain access. Probably your encrypted file can store this credential as well.