121 reputation
6
bio website
location Netherlands
age
visits member for 2 years, 10 months
seen Sep 8 at 11:45

Feb
20
comment Start/Stop IIS site automated as an administrator, which is not a built-in “Administrator”
@user2196728 That would work, but would also lead to 2 major security flaws. You have to enable the built-in Administrator account, and you will have to store Administrator login credentials unencoded. Most probably just in plan text format.
Feb
19
asked Start/Stop IIS site automated as an administrator, which is not a built-in “Administrator”
Oct
13
awarded  Informed
Oct
8
awarded  Supporter
Oct
7
comment How to secure a single file download over HTTP on IIS?
@TessellatingHeckler Thank you, theoretically that should do it. Please post the content as an answer for those that are also interested. I must say this is a very complex way to do it. Personally I don't think I'm prepared to perform all these steps for every secure download I want to serve. Lets hope there is a more clean way...
Oct
7
revised How to secure a single file download over HTTP on IIS?
added 13 characters in body
Oct
7
asked How to secure a single file download over HTTP on IIS?
Sep
10
awarded  Commentator
Aug
28
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
Ok. Thanks. Now I can answer your question. The encrypted storage of the MySQL credentials will protect from intruders that don't have admin access to the OS, but read files, run processes as a compromized service or a malware application.
Aug
28
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
Thank you for the effort and for this find. So far I'm also only finding source code examples, no reliable tools. As far as I could find, CryptoAPI also can't be called through command line directly, only by function calls. If I find no reliable tool, I may setup a C++ environment (in which I never programmed) and use this example to write custom command-line tool, with all the risks and time investments.
Aug
28
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
@Zoredache You seem to know a lot about security. Is it really that easy to get access to all MySQL databases? Because that's shocking. What exact options do you refer to? I want to know what the intruder will be capable of. Also would you mind to explain how partition encryption (bitlocker) could prevent a hacker from stealing data or messing up the mysql server?
Aug
27
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
We are getting closer. Vault apparently uses Windows user credentials to encrypt connections.xml containing passwords. There is no other encryption string storage needed. The only thing we need now is a tool that can be called programmatically to store & retrieve passwords using MS CryptoAPI.
Aug
27
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
Don't get this wrong. That is also exactly what I want to achieve: store passwords. Storing it cleartext may lead to company's bankruptcy in case of an incident. So the only option is to encrypt. Reversible encryption will of course mean that I need to store the encryption string somewhere. Programs like MySQL Password Storage Vault most certainly uses encryption string decode algorithms that are compiled using reverse engineering protection techniques, which make the extraction of the encryption string extremely difficult, even for experienced hackers. This is 'safe enough'. It's possible.
Aug
27
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
I can't vote down, but this is -1. Passwords in MySQL need only to be PASSED as cleartext. It has nothing to do with storage. MySQL Workbench's Password Storage Vault is an excellent proof of that. (this brings me to an idea to dig into the docs, maybe I can use the vault). There are also ways to use 3d party automation tools like Finalbuilder, which have password storage for things like zip archives, which can be used to temporarily extract credentials and cleanup afterwards.
Aug
27
awarded  Editor
Aug
27
revised How to run a mysqldump automated with SAFELY stored mysql credentials?
added 39 characters in body
Aug
27
comment How to run a mysqldump automated with SAFELY stored mysql credentials?
@Zoredache Thank you for clarifying that. I just went one step backwards from the solution.
Aug
27
asked How to run a mysqldump automated with SAFELY stored mysql credentials?
Mar
16
awarded  Student
Feb
24
comment How to include PHP file from a Virtual Directory on IIS?
Got it done using hostname as client identifier, like you suggested. include($_SERVER['DOCUMENT_ROOT'] .'\\'. $_SERVER['HTTP_HOST'] .'\\userconfig\\config.php');. Thanks. I wonder if there are any security issues related to this approach...