新手尝试部署 Asp.Net 网站
我基本上想知道部署 Asp.Net 网站的最佳方法是什么，主要是从安全的角度来看。现在，我正在尝试使用 Visual Studio 2010 发布网站。有人可以指导我找到有关如何安全地执行此操作的好教程吗？例如，可以通过 Visual Studio 通过加密连接来完成吗？是否需要在服务器上安装任何软件才能做到这一点？我应该首先使用不同的程序打开 SSL (TLS) 连接吗？如果是，使用哪个程序（它是 Windows 的标准配置）？
服务器运行的是 Windows Server 2008。开发是在 Vista 上进行的。
非常感谢您对此事的任何指导！
安德鲁
I'm basically wondering what the best way to deploy an Asp.Net Web Site is, mostly from the point of view of security. Right now, I'm trying to publish the website using Visual Studio 2010. Could someone direct me to a good tutorial on how to do this securely? For example, can it be done over an encrypted connection via Visual Studio? Is it necessary to install any software on the server to do this? Should I use a different program to open up an SSL (TLS) connection first, and if so, which program (does it come standard with windows)?
The server is running Windows Server 2008. Development is on Vista.
Many thanks in advance for any direction in this matter!
Andrew
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我会将网站发布到您的本地计算机，并将文件复制到您的测试/生产环境。通常，我们不会直接从 VS 发布站点以进行测试或生产。
例如，您不想意外地将东西从开发环境直接推送到实际环境中，不是吗？
就文件传输安全性而言，您可以使用 SFTP。
I would publish the site to your local machine and file copy the files across to your test/production environment. As a rule we don't publish sites straight from VS to test or production.
For example you don't want to accidentally push things straight from dev into a live environment do you?
As far as the file transfer security goes you could use SFTP.
注意：首先要咨询服务器的所有者，因为他们通常会为您提供 FTP 连接并负责配置 IIS。
如果您想添加安全性、创建密钥文件并对程序集进行签名并考虑在 dll 上运行 Dotfuscator，则 Visual Studio 中包含社区版。这是一个较早的问题，我在其中提供了有关 Dotfuscator 的更多信息。
如果您必须自己进行部署，则需要考虑以下几点。
使用 Visual Studio 进行部署没有安全优势，但您可以使用 Visual Studio 创建一个小型安装程序。为了安全起见，您要确保的一件事是不要部署任何 .cs 文件。准备你的文件，你应该在Release模式下编译，确保你的配置文件中没有启用调试，保留你的bin和它的dll，还有aspx、asmx、ascx、svc、css、js和配置文件。
以下是来自官方 ASP.Net 网站 的有关最佳实践的额外信息。
Note: First thing is to check with the owner of the server, as they often will provide you an FTP connection and will take care of configuring IIS.
If you want to add security, make a keyfile and sign your assemblies and consider running Dotfuscator on your dlls, the community edition is included in Visual Studio. Here is an earlier question where I've put more info on Dotfuscator.
If you have to do the deployment yourself, here's a few things to consider.
There is no security advantage in deploying using Visual Studio, but you can use Visual Studio to create a small setup program. One thing you want to make sure for security is DO NOT deploy any .cs files. Prepare your files, you should compile in Release mode, make sure debug is not enabled in your config file, keep your bin and it's dll, also the aspx, asmx, ascx, svc, css, js, and config files.
Here is extra info on best practices from the official ASP.Net website.
如果您对服务器有一定的控制权（例如配置 IIS7），您可能需要研究一下 Microsoft Web Deploy（刚刚发布的新产品）：
http://weblogs.asp.net/scottgu/archive/2010/09/13/automating- Deployment-with-microsoft-web-deploy.aspx
我自己还没有尝试过，但看起来相当光滑，而且它显然对复制的数据进行了加密，所以可能适合您。
If you have some control on the server (e.g. to configure IIS7), you might want to look into Microsoft Web Deploy (new product just been released):
http://weblogs.asp.net/scottgu/archive/2010/09/13/automating-deployment-with-microsoft-web-deploy.aspx
Haven't tried it myself, but looks quite slick and it apparently encrypts the data being copied up, so might suit you.