How to secure connection strings in VS?

Question

I see several others have posted this question, however, none of the solutions I've tried have fixed this yet. I have a 32-bit XP running VS 2008 and I am trying to encrypt my connection string in my web.config file.

But I am getting the error: The configuration section '...' was not found. Failed!

The command I give it: C:\Program Files\Microsoft Visual Studio 9.0\VC>Aspnet_regiis.exe -pe "system.we b/AdventureWorksConnectionString2" -app "/Documents and Settings/Admin/My Docume nts/Visual Studio 2008/Projects/AddFileToSQL2"

Also, how does -app map virtual directory? In other words the path above is the directory right below c:. Is this the correct path to use? And AddFileToSQL2 is the name of my project, although it is part of the AddFileToSQL solution.

I have this folder web shared with all of the permissions.

And the relevant part of my web.config file:

  <add name="AdventureWorksConnectionString2" connectionString="Data Source=SIDEKICK;Initial Catalog=AdventureWorks;Persist Security Info=true; User ID=AdventureWorks;Password=sqlMagic"
    providerName="System.Data.SqlClient" />

Answer 1

With DPAPI, you can only encrypt whole sections as far as I know. Thus, you cannot encrypt just your one connection string but the entire connectionStrings section. Second the -app refers to the virtual path to the application on your IIS server in which it should find the given section and config file. Thus, if your site look like this:

root
    /appFoo

And you wanted to encrypt the connection strings in /appFoo you would do

aspnet_regiis -pe "connectionStrings" -app "/appFoo"

How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI