0

We got a situation where we need to write a windows service using c#, the service need to be install on a particular -single- server. Also service need to communicate with a DB to access certain table to process data.

What will be the best approach to pass on the credentials to this service?

We have built the service, but now doing some R&D about passing credentials. We don't want to save them hard coded inside the code of course, also we don't like the idea of saving them in the file on server. We are thinking of passing it as parameters, when we install the service using InstallUtil.

What do you guys think, is it good or there is something better to it?

1

The best approach is to store these in an encrypted section of your config file, the key to encrypt this should be stored in Windows protected storage for the user it runs as (ie no-one else, not even another admin can then access it). This assumes you need to store and use these credentials to pass on to access the DB, if you are simply running the service as particular user, simply install it as that user. Create a user specifically to run this service, that's even better for security.

With this approach, you're using Windows for security, any private data (eg connection string to the DB) is encrypted so only the service user can access it, and Windows takes care of all the details.

Do not pass them as (commands line) parameters to the service - anyone with rights to view Service control panel applet will be able to see them!

Also, make sure you use AD domain users - NTLM is crackable in minutes with today's hardware,

  • If I'm not mistaken, Windows Protected Storage is depreciated and Windows Data Protection should be used instead. – Arseni Mourzenko Jul 6 '15 at 8:16
  • 1
    @MainMa I'm not sure (of which damn thing Microsoft says we should use anymore) - but its the Protected Storage service that is deprecated (since Vista) not this Protected Configuration thing, at least that's what a quick google tells me. I'm tempted to become a FreeBSD dev every time this happens. – gbjbaanb Jul 6 '15 at 8:26
  • @gbjbaanb I will be honest, I went through the link, didn't try anything. It talks about asp.net. Can I do the same for Windows Services, have an app.config file with all the details encrypted and everything else you mentioned? – Hitin Jul 6 '15 at 13:37
  • I know its all asp.net config, but the same principles apply to normal ones, I've used used exactly that for standalone service-based WCF web service. You may need to google for further help, but that link is the MS reference for it (IIRC) – gbjbaanb Jul 6 '15 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.