1

I start by saying that I am not really familiar with AD and DMZs.

In my company, we have a DMZ with one server, isolated from the internal network (only a few open ports) and exposed to the web. There are some IIS applications running which have access to the SQL Server.

I wanted to update the connectionstrings, remove userId and password, use Integrated Security = true and set a proper user to the application pool in order to remove the cleartext/hardcoded password from the web.configs.

The problem is that the server does not recognize the user, since the server is not part of the AD domain.

I'm quite sure there is a clean solution for such a scenario, but no clue. What should I do?

Improve this question
6
  • You can only use “Integrated Security = true” if your web server is joined to the same domain (or a trust relationship exists) as the SQL server.
    – Greg W
    Jul 8, 2020 at 0:19
  • So what do you suggest? Sould I add the server to the domain in oder to be able to use Integrated Security = True?
    – Emaborsa
    Jul 8, 2020 at 10:01
  • That decision is up to you. Is it an insurmountable objective or something that can easily be done?
    – Greg W
    Jul 8, 2020 at 10:29
  • I think it's not a matter of how much effort such a change requieres, but rather about security. I am trying to understand if it's better to keep the password visible, keep the server outside of the domain, or maybe another solution.
    – Emaborsa
    Jul 8, 2020 at 11:03
  • Integrated security is more secure as the authentication isn’t in the clear (and even more secure if using Kerberos). That said, the server is in the DMZ for a reason and domain-joining DMZ servers come with it’s own risks.
    – Greg W
    Jul 8, 2020 at 11:06

2 Answers 2

Reset to default
2

I wanted to update the connectionstrings, remove userId and password, use Integrated Security = true and set a proper user to the application pool in order to remove the cleartext/hardcoded password from the web.configs.

As others have stated, you cannot use integrated security if the system is not joined to Active Directory.

You also don't need to do this because the connection strings can be encrypted.

Use the following commands from a command prompt where the web.config is located:

%SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -pef connectionStrings "."

If the app pool runs under an account and not local system:

%SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis -pa "NetFrameworkConfigurationKey" "accountusername"

If there are multiple IIS servers in a farm, they all need to have the same machine key, which they probably already do.

More information:

https://docs.microsoft.com/en-us/aspnet/web-forms/overview/data-access/advanced-data-access-scenarios/protecting-connection-strings-and-other-configuration-information-cs

Improve this answer
4
  • Good point. It doesn’t avoid the credentials being sent in the clear to SQL Server unless that connection is encrypted also.
    – Greg W
    Jul 8, 2020 at 21:31
  • I already knew that option, but i had some problems and no one answered on my post. stackoverflow.com/questions/61679016/…
    – Emaborsa
    Jul 9, 2020 at 7:47
  • @GregW: Yes that is a different wormcan. The only way to truly address that is to enforce encryption from the server side. Difficult to do after the fact. Of course the client could opt in to using encryption, but that isn't optimal.
    – Greg Askew
    Jul 9, 2020 at 16:20
  • Does it matter with which user I encrypt?
    – Emaborsa
    Aug 27, 2020 at 9:38
0

Create a user on the DMZ server and assign it to the application pool. Create a local user on the SQL server and give it permissions in SQL management studio

Improve this answer
2
  • I fear it is not possible, as far I've understand a user has to be in the same user domain
    – Emaborsa
    Jul 9, 2020 at 7:49
  • Have you tried it?
    – Timothy Frew
    Jul 10, 2020 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .