Implementing Protected Configuration With Windows Apps

7:28 29 Aug '07

Great article Hameer!

I am challenged c# wise but when I try to implement the sample you provided I get the following error in the app.config file:

The useMachineProtection directive is flagged as "The useMachineProtection attribute is not defined."

Do I have to add a reference to my project in order to get this to work correctly?

Thanks in advance - I hope you are still watching this post as I could use this functionality,

Steve

20:34 29 Aug '07

Dear Steve, Have you added a reference to System.Configuration assembly, as DpapiProtectedConfigurationProvider is defined in this assembly. Also make sure the configProtectedData section is defined below the configuration section in App.config. Regards, Hameer Saleem
Sign In·View Thread·PermaLink

12:39 30 Aug '07

Hello Hameer,
Yes, I have the reference to the System.Configuration assembly in my code and the configProtectedData section is defined below the config section in the app.config file.

It turns out that the useMachineProtection issue was just a warning in the config file. I was getting an object not found error; on the version I built from your explaination and a second version of the program using the code copied in from your project.

I couldn't figure out what was not defined right (it all looked good to me) so I dropped back and tried to simply protect the DataProtect.vshost.exe.config file. My protect runs (in debug) with no errors but the config connectionStrings section is not encrypted. I started with a new program and copied the configProtectedData xml tag from the machine.config file just to be sure that I didn't make a type-o. I ran my program and it worked; once! I could not get it to work a second time. Blech!

I went back to your program and then it worked. Any idea what I could be encountering? I am working in VS 2005 with Framework 2 & 3 installed.

This is so frustrating; especially when others like yourself have had good success. Also, once the installer runs how can I update the config file if the connection details change? Would I have to redistribute the program?

Thanks so much for following up with me, Smile

Steve

18:56 30 Aug '07

Hi again Hameer,
I just stumbled unto something interesting. My DataProtect.vshost.exe.config > connectionStrings section is only encrypted while the program is running! As soon as the program completes it goes back to the unencrypted state. I am totally baffled, this doesn't look right looking at your post above. Here is the code that I am using to protect the section (sorry it is vb.net, I mentioned that I was C# challenged right?):

  ' Protect the connectionStrings section.
  Private Sub ProtectConfiguration()
    ' Get the application configuration file.
    Dim config As System.Configuration.Configuration = _
    ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None)
    ' Define the Dpapi provider name.
    Dim provider As String = "DataProtectionConfigurationProvider"
    ' Get the section to protect.
    Dim connStrings As ConfigurationSection = config.ConnectionStrings
    If Not (connStrings Is Nothing) Then
      If Not connStrings.SectionInformation.IsProtected Then
        If Not connStrings.ElementInformation.IsLocked Then
          ' Protect the section.
          connStrings.SectionInformation.ProtectSection(provider)
          connStrings.SectionInformation.ForceSave = True
          config.Save(ConfigurationSaveMode.Full)

          Console.WriteLine("Section {0} is now protected by {1}", _
          connStrings.SectionInformation.Name, _
          connStrings.SectionInformation.ProtectionProvider.Name)
        Else
          Console.WriteLine("Can't protect, section {0} is locked", _
          connStrings.SectionInformation.Name)
        End If
      Else
        Console.WriteLine("Section {0} is already protected by {1}", _
        connStrings.SectionInformation.Name, _
        connStrings.SectionInformation.ProtectionProvider.Name)
      End If
    Else
      Console.WriteLine("Can't get the section {0}", _
      connStrings.SectionInformation.Name)
    End If
  End Sub 'ProtectConfiguration

Config file:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
</configSections>
<connectionStrings>
<add name="UsingDpapi.My.MySettings.ConnectionStrings" connectionString="Data Source=1.1.1.1;Initial Catalog=XXXXXX;Persist Security Info=True;User ID=XXXXXX;Password=XXXXXX" providerName="System.Data.SqlClient" />
</connectionStrings>
<configProtectedData>
<providers>
<add name="DataProtectionConfigurationProvider" type="System.Configuration.DpapiProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" useMachineProtection="true" keyEntropy="" />
</providers>
</configProtectedData>
</configuration>

Do you see anything that is not correct? I'm not sure why this would not be working right - it reflects a few examples that I have found.

Steve

22:03 30 Aug '07

Dear Steve, Can you please paste your code here so that i have the clear idea what exactly are you trying to achieve and how.
Sign In·View Thread·PermaLink

11:48 31 Aug '07

Good day Hameer,
My previous post lists the ProtectConfiguration subroutine logic and config xml listing associated with my prototype. I will list the main (calling) module below. My purpose in this program is to get a working sample that will consistently encrypt the app.config (UsingDpapi.exe.config or UsingDpapi.vshost.exe.config in effect) file. Once that is done I can incorporate the logic into my final solution.

I am still curious on this question... Regarding the solution you posted above, once the installer runs how can I update the config file if the connection details change? Would I have to redistribute the program?

Again, thank you so much for answering my questions,
Steve

  Public Sub Main(ByVal args() As String) 'Passing in 'protect' text
    Dim selection As String = String.Empty
    If args.Length = 0 Then
      Console.WriteLine( _
      "Select protect or unprotect")
      Return
    End If

    selection = args(0).ToLower()

    Select Case selection
      Case "protect"
        ProtectConfiguration()
        Exit Select
      Case "unprotect"
        UnProtectConfiguration()
        Exit Select
      Case Else
        Console.WriteLine( _
        "Unknown selection")
    End Select
    Console.WriteLine("Press Enter to exit.")
    Console.Read()
  End Sub 'Main

20:39 31 Aug '07

Dear Steve,

It seems you missed the Introduction part of this article which states just your problem.

If you are in Debug mode, Visual Studio Hosting Process in enabled by default. So, if you are calling ConfigurationManager.OpenExeConfiguration,
this will open Exe_Name.vshost.exe.config instead of Exe_Name.exe.config and Exe_Name.vshost.exe.config is overwritten on each build (hence you loose the changes). In order to encrypt Exe_Name.exe.config instead of Exe_Name.vshost.exe.config, try disabling the visual studio hosting process or run the project in release mode.

Note, even if you have disabled the Hosting Process or have used release mode, the actual file encrypted will be Exe_Name.exe.config not the app.config itself. And we know that the Exe_Name.exe.config will always be overwritten by the contents of app.config file each time we build our project. So in this case too you will loose the changes made by you the first time.

So these are part of the pain areas due to which i suggest that one should encrypt it in the installer instead of in some custom application.

To answer your question about the chnaged connection string setting. Yes, you will have to redistribute the Setup in this case. Or you can make a utility application for updating the Exe_Name.exe.config file.

To add a little more to the annoyance, while debugging, one wouldn’t even notice the change in the Exe_Name.exe.config file if the Visual Studio Hosting Process in enabled (which is enabled by default). If so, Exe_Name.vshost.exe.config will be encrypted instead. So all this will make the process of porting the encrypted version of the configuration file from production to deployment a headache.

Regards,
Hameer Saleem

Yes but.. anyone with Visual Studio installed could decrypt it quite quickly.

4:13 4 Sep '07

Hello Hameer,
Actually, I do understand what is happening by the builds overwriting the associated config files. The thing that I am struggling with at the moment is that the appropriate config file is encrypted but only as long as my program is running, i.e., not until the next build. So as soon as my program finishes running the config that was encrypted is no longer encrypted and I have not done a build yet either.

My requirements for this project are to periodically change the connection details. My goal is for the program to detect a change to the connection details (unprotected state) and then re-encrypt the config file sections. I have done this using registry entries but some admins are more comfortable with editing config files rather than the registry.

Steve

DiscernIt

1:23 16 Aug '07

Tried this solution but isn't completely secure. If the encryption is done at install time with a machine key that key is available to the user... so anyone with VS installed can create a quick app, overwrite the app.config with your encrypted app.config (rename a few namespaces etc..) VS uses the same key and decrypts it for all to see. www.discernit.co.uk
Sign In·View Thread·PermaLink	5.00/5 (1 vote)

Re: Yes but.. anyone with Visual Studio installed could decrypt it quite quickly.

zawmn83

22:24 17 Sep '07

That's right. If you have any idea, let me know how can I protect it.
Sign In·View Thread·PermaLink	2.00/5 (1 vote)

How to add C# code in msi setup

rishi_palani

2:42 8 Aug '07

Dear friend, I have created the msi installer setup using visual studio2005 and after installed the application, i can't able to launch the desktop shortcut quick icon. how to add the C# code base with msi installer setup. Now, i need to add programfolder path and settings entry to write into the .ini file. Thanks Please help me this. Rajarishi
Sign In·View Thread·PermaLink

How can we encrypt that newly added connectionstring?

vijay@kommula

0:31 7 Aug '07

very nice article and more helpful.thank you very much?
After installation of application. I deleted the crypted connectionstring and added new connectionstring(with changes but valid one). Now after successful running of application, in config file it is not showing encrypted connectionstring(I know u wrote code in installer file.).
I want to know how we can encrypt that newly added connectionstring(added after installation)?

vijay

2.00/5 (1 vote)

It failed

nhungt

8:42 20 Jul '07

Thank you for provided the code. It is really clearly. I followed the code. When I build the app.config. It gave me two errors: The 'requirePermission' attribute is not declared. The 'useMachineProtection' attribute is not declared. Please help me with this problem. Thanks again. Nhung
Sign In·View Thread·PermaLink

Re: It failed