1

Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. Obviously this is nasty as anyone with access to the server or the source code can gain immediate access to the database (if they have firewall access etc).

I'm assuming that there is a recommendation on how to do this more securely (even a DSN would be better I guess?)

Any suggestions welcomed - hopefully not a load of "what year are we living in comments" ;-)

Improve this question
2
  • 1
    Basically, you shift it to a difficult to access file. I'm sure someone will come along with specific details, but it is one of the times when a plain text password is needed at some point. Can't connect to the db without the password, and no point in encrypting it, since wouldn't be able to connect without decrypting first, which would require a password, and so on!
    – Matthew
    Oct 29, 2015 at 9:52
  • OK that's what's been done I think... is a DSN no more secure?
    – Steve
    Oct 29, 2015 at 12:04

2 Answers 2

Reset to default
1

You should do it the same way you do everywhere else: use env vars.

Set O/S env var for user foo. Run application as user foo. Only foo or root can read that env var. Root can always read everything, including files.

Env vars are better than files as they are safer by default (ever screwed up a file permission?) and prevent you from accidentally checking passwords into source control, because you can't.

See https://stackoverflow.com/questions/6360036/getting-environment-variables-in-classic-asp

If you're opening child processes, pass them a clean environment.

Improve this answer
3
  • Sorry I don't see how that can be done. The application needs to connect to the database with a password are you suggesting I somehow have a login session and leave it open for the application to use?
    – Steve
    Oct 29, 2015 at 17:23
  • Nope. Suggesting that you store the db password in an o/s environment variable, read it on startup (same as you would a file), and use that in your db connection string. You could use an external file too, but env vars are a more general solution (esp for open source projects). The best you can do is control access to the password. Encrypting it won't help, as your app needs access to the key anyway. HSM protects the key, but can still be used by root
    – Neil McGuigan
    Oct 29, 2015 at 19:27
  • Can you point me to somewhere that explains how to do this... I don't understand how it can be done.
    – Steve
    Oct 31, 2015 at 19:15
-1

suppose your asp program is stored under root directory named httpdocs

now , create a virtual folder (inside httpdocs) let's say includeasp that points to a folder named cgi-bin(which is in the same folder as httpdocs).

means the directory tree should be like this somefolder httpdocs cgi-bin (your asp files) (contains password inside global.asp file) httpdocs and cgi-bin are brother folders

then in the folder cgi-bin, create an asp program global.asp with following code global_id="yourdatabaseid" global_password="yourdatabasepassword"

once this file is created, then in your asp program that contains connectionstring value for database, write this line before tag starts as comment of html #include virtual="/includesasp/global.asp"

now the variables global_id abd global_password are available and you can specify them inside your connectionstring.

So simple....moreover, if a hacker somehjow downloads this asp code, thenhe will not be able to see database id and password. it is guaranteed that since the folder cgi-bin is not there inside httpdocs folder, so hacker cannnot copy that file which contains actual id and password

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .