一.利用代码加解密
// 加密web.Config中的指定节 private void ProtectSection( string sectionName) { Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); ConfigurationSection section = config.GetSection(sectionName); if (section != null && ! section.SectionInformation.IsProtected) { section.SectionInformation.ProtectSection( " DataProtectionConfigurationProvider " ); config.Save(); } } // 解密web.Config中的指定节 private void UnProtectSection( string sectionName) { Configuration config = WebConfigurationManager.OpenWebConfiguration(Request.ApplicationPath); ConfigurationSection section = config.GetSection(sectionName); if (section != null && section.SectionInformation.IsProtected) { section.SectionInformation.UnprotectSection(); config.Save(); } } 加密后:
<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider"> <EncryptedData> <CipherData><CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYzAtjjJo0km/XdUrGFh3YAQAAAACAAAAAAADZgAAqAAAABAAAAD5H0RB6uSYHCk33lo9x5VHAAAAAASAAACgAAAAEAAAALS6KNeUNySZfZ/0tpmh7YWAAQAA85NFHJH
oVx1aW5pTaFfLtTo5J9lWoBR76IYIinLiIjcTeJ4tuAstgCspZlK9NMgzyWmWbbNbb8Z8canVCUpdKF0xmTBTpVih08TtODLszcUpCsJGvEgxuDPi6JtKjG/nT+UvpRp154TNnm04LP/iq1InDxePW2tEViHIiooEXARX8FLY00R
FBaUgarrfi5Fppu4usqavdnj7oqwFEbp3MXOaWY6m9qyVzNsf2G1UwBrivsrM4hZUcr1hy/S87co63ioWie8QDVgGuaTEaSyklC9STyvRsLU6A/QxalCHY4VoRjzNS/27vGoin+c3AJ587wMKJyJBiV08DyzoGM7elAlg8yTAeHv
VMLOEFcTUwsCG0f2rwhi3fZYUyykczYsfHXLEXdbJ+YRiBxYWP6xzffIdyWzrawxaIfnPq/pw6e2Vrwt6tJthDImu0tzXdwupbJVdy4T5vQvy4Fw3SB9lmbSZQacekaXcViBdX7Tejx7TTpDs36RdAOf8WcVMJH4FFAAAACjQFCa
OcSfbD2LXX4YP506vHDXw</CipherValue>
</CipherData> </EncryptedData> </connectionStrings>注意:
加密后，仍然可以按以前的操作来读取，不需要额外的解决操作,因为<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">这里已经指定了用何种方式解密，asp.net会自动处理
二.利用aspnet_regiis.exe工具加解密
步骤:1.先在本地生成RSA容器(有关RSA的详细操作，可参见 )aspnet_regiis.exe -pc "JimmyKeys" -exp注:JimmyKeys为容器名字，可随便改
2.再将RSA导出到xml文件aspnet_regiis.exe -px "JimmyKeys" "c:\JimmyKeys.xml"
3.在web.config中增加一节,一般放在<appSettings>之前就可以了，如下
<configProtectedData> <providers> <add name="JimmyRSAProvider" type="System.Configuration.RsaProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" keyContainerName="JimmyKeys" useMachineContainer="true" /> </providers> </configProtectedData>
<appSettings> ... 4.将web.config加密aspnet_regiis.exe -pef "appSettings" "c:\website" -prov "JimmyRSAProvider"
解密:aspnet_regiis.exe -pdf "appSettings" "c:\website"
5.部署到远程服务器(1台或多台)a.将网站文件与JimmyKeys.xml(也就是导出的RSA容器文件)先上传到服务器,同时导入RSAaspnet_regiis.exe -pi "JimmyKeys" "c:\JimmyKeys.xml"
b.确认服务器上aspx登录所用的默认帐号Response.Write(System.Security.Principal.WindowsIdentity.GetCurrent().Name);随便建一个aspx，把上一行代码贴到里面就可以了，IIS5环境下输出的是ASPNET，IIS6环境下输出的是NETWORK SERVICE，IIS7下没试过也不知道输出的是啥玩意儿
c.授于RSA窗口的读取权限给b中的默认帐号aspnet_regiis.exe -pa "JimmyKeys" "NETWORK SERVICE"
顺便把刚才这些个操作的命令整理成几个批处理1.本机bat(新建RSA容器，导出容器，加密web.config)%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pz "JimmyKeys" %windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pc "JimmyKeys" -exp%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -px "JimmyKeys" "c:\JimmyKeys.xml"%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pef "appSettings" "c:\website" -prov "JimmyRSAProvider"
2.远程服务器bat(导入RSA容器，授权)%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pi "JimmyKeys" "c:\JimmyKeys.xml"%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -pa "JimmyKeys" "NETWORK SERVICE"
加密前:
<connectionStrings> <add name="connStr" connectionString="Data Source=server;Initial Catalog=Lib;User ID=sa;password=***" providerName="System.Data.SqlClient" /> </connectionStrings>加密后:
<connectionStrings configProtectionProvider="JimmyRSAProvider"> <EncryptedData Type="" xmlns="#"> <EncryptionMethod Algorithm="" /> <KeyInfo xmlns="#"> <EncryptedKey xmlns="#"> <EncryptionMethod Algorithm="" /> <KeyInfo xmlns="#"> <KeyName>Rsa Key</KeyName> </KeyInfo> <CipherData><CipherValue>breSi2wD4X4CAKh0puzhYtyltmR3cp9JfEE8Yw03NeWGZCOoEvDuxAceKLEsmYx8r/tI5NsZxOmY20pQzD1KvGELzz4rhkEPE9LKTAwyKNhqzMPFoRnjsdGTvs6JhrvVat9rdvgKbfTvVLXuvpXgSeNB0T6XJWq
/vOIU7KTyFjk=</CipherValue>
</CipherData> </EncryptedKey> </KeyInfo> <CipherData><CipherValue>c4HD+EfJl//pv4eEzT938aWYhLyPBUt8lbNWf4Y4c6tewWLNBTwgYXtxPh6TnF8ne6s9H5C/AwXy/3JECuNEd8YGOO+RDhxw8NySd8vUc53+iUiHW5TLs/aoIvy8k1yOfLWGKFFWPtoX4F4gMTS+MAmhkiHQ46p
H2VyjyprNsl8LE2pGNjDOJnDeGYq+wkn2iw968+qjuTCibGJn6h6iGYGHYmkYUrgRzfo3iIZu+eCWE2IqCP+s58eQRjU3MxJ2BqeUU9HaKy4=</CipherValue>
</CipherData> </EncryptedData> </connectionStrings>同样，这种方式加密后，aspx读取节点时也无需任何解密处理，代码不用做任何修改
注意:并不是所有的节点都能加密，ASP.NET 2.0仅支持对Web.config的部分配置节进行加密，以下配置节中的数据是不能进行加密的：• <processModel>• <runtime>• <mscorlib>• <startup>• <system.runtime.remoting>• <configProtectedData>• <satelliteassemblies>• <cryptographySettings>• <cryptoNameMapping>• <cryptoClasses> 另外，除了AppSettings和ConnectionStrings以外的其它节点，可以这样写:aspnet_regiis.exe -pef "system.serviceModel/behaviors" "d:\website\cntvs\" 即对<system.serviceModel>下的<behaviors>节点加密,这一节点同样适用于代码方式加密，经过多次尝试，似乎除了AppSettings和ConnectionStrings以外的其它节点，只能支持二级节点。象以下写法:
aspnet_regiis.exe -pef "system.serviceModel/behaviors/endpointBehaviors" "d:\website\cntvs" 运行时会报错:未找到配置节“system.serviceModel/behaviors/endpointBehaviors”。