服务帐户的正确密码存储和检索？
我发现和阅读的有关在数据库中正确存储密码的大多数信息都表明，我应该使用每个用户的唯一盐值对密码明文进行哈希处理，然后将该哈希值存储在数据库中。但这个过程不能满足我的需求...
我有一个用 C# 编写的 Windows 服务，需要使用特定的服务帐户连接到不同数据中心中的其他远程计算机。这些服务帐户就像域用户帐户，但它们背后没有真正的人，它们只是拥有在每个特定服务器上执行服务负载的适当权限。服务帐户信息存储在 SQL Server 表中，包括每个帐户的密码。目前，我正在使用对称加密（Rijndael）来混淆数据库表中的密码。密钥保存在具有严格访问权限的单独配置文件中。
每次服务有预定的有效负载在远程计算机上运行时，我都会在表中查找适当的服务帐户信息并使用密钥对其进行解密。还有一个内部网站，基本上是用于管理该服务的各种设置的前端，管理员可以在其中查看和更改服务帐户的密码。
这是保证事物安全的好方法吗？这个方案有什么明显的缺陷吗？
Most of the information that I found and read about properly storing passwords in a database say that I should Hash the password clear text with a unique salt value for each user and then store that hash in the database. But this process doesn't work for my needs...
I have a windows service written in C# that needs to connect to other remote machines in different datacenters using specific service accounts. These service accounts are like domain user accounts, but there is no real people behind them and they just have the proper permissions to carry out the service payload on each specific server. The service acount information is stored in a SQL Server table including the password for each account. Currently, I am using symmetric encryption (Rijndael) to obfuscate the passwords in the DB table. The key is saved in a separate config file that has strict access permissions.
Every time the service has a scheduled payload to run on a remote machine, I lookup the appropriate service account information on the table and decript it using the key. There is also a internal website that is basically a front-end for managing the various settings for this service, and in there the admin can view and change the password of the service accounts.
Is this a good approach to keeping things secure? Are there any obvious flaws in this scheme?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
对我来说听起来很理智。
Sounds sane to me.