When hosting a site on a cluster (or cloud configuration) we need to specify a Machine Key in the web.config file. This is needed to keep the machines in sync (often the first encounter with this is when you have to log in repeatedly after every one or two page loads).
Apart from database credentials, the config may contain some other credentials that may be of more direct use to an attacker, like root-admin credentials for forms-authentication (used for making and restoring database backups for example, where the user must be able to log in without relying on the database).
Is it possible to encrypt these sections with the provided means, since the "machine key" is defined in the same config file? If that key be used we have a nice chicken-egg paradigm!
It's shared hosting, so running aspnet_regiis is out of the question. I've also seen a lot of "Object already exists" and "key container could not be opened" problems on shared hosting when attempting to programmatically achieve encryption on projects that did not even utilize load balancing.
My question is, is it technically possible to encrypt the sections on shared- load-balancing (machine key in config) hosting with the standard instrumentation or should I spare any efforts.