我有一个 MVC2 .NET 4.0 应用程序，托管在 TFS 2008（即将成为 TFS 2010）上，它使用 web.config 中的连接字符串连接到另一台服务器上的数据库。我需要加密这些连接字符串。
据我了解，我可以使用 aspnet_regiis.exe 来加密 web.config 文件的连接字符串部分，但我必须在部署计算机上执行此操作因为加密使用机器名来生成加密密钥。
现在，在我看来，这代表了一个问题 - 每次我将代码部署到开发服务器时，它不会覆盖 web.config 文件，并且需要重新加密吗？这种手动过程似乎很笨拙。
-
我对部署后需要重新加密的理解是否正确？
-
如果是这样，有什么方法可以自动化这个过程吗？我不想忘记这一点，也不想找一个不了解该流程并将连接字符串暴露给外界的新团队成员。
I have an MVC2 .NET 4.0 app, hosted on TFS 2008 (soon to be TFS 2010) that uses connection strings in web.config to connect to a database on another server. I need to encrypt these connection strings.
As I understand it, I can use aspnet_regiis.exe to encrypt the connectionstring portion of the web.config file, but I have to do it on the deployment machine because the encryption uses the machine name to generate the encryption key.
Now, it seems to me that this represents a problem - every time I deploy my code to the dev server won't it overwrite the web.config file, and need to be re-encrypted? This sort of manual process seems kludgy.
-
Is my understanding about needing to re-encrypt after deployment correct?
-
If so, is there some way to automate this process? I don't want to forget this or get a new team member who doesn't know the process and have the connectionstring exposed to the world.
发布评论
评论（1）
web.config 文件通常不是部署的一部分（尽管 Visual Studio 2010 支持配置Web 应用程序部署项目中的文件转换）。我不希望您在部署时覆盖 web.config （因为 web.config 是您放置特定于该计算机/环境的内容的地方。
因此，对其进行加密一次，然后不要我的建议是覆盖它，
因为这在您的情况下不可用，因此可以在加密时指定密钥，以便您可以在计算机之间共享加密的文件。默认情况下，加密命令使用 DPAPI 来进行加密。加密该部分（与计算机绑定），但您也可以使用 RSA 进行加密，更多信息请参见 MSDN 中的 指定受保护的配置提供程序。
web.config files aren't typically part of a deployment (though Visual Studio 2010 supports configuration file transforms in web application deployment projects). I wouldn't expect that you should be overwriting the web.config when you deploy (because the web.config is where you would place those things that are specific to that machine/environment.
So, encrypt it once, and then don't overwrite it, would be my advice.
Since that isn't available in your situation, it is possible to specify a key when encrypting, so that you can share the encrypted file between machines. By default, the command to encrypt uses the DPAPI to encrypt the section (which is tied to the machine) but you can also use RSA for encryption. More info is available on MSDN in Specifying a Protected Configuration Provider.