Secure credential storage when I need to get a password to use

Question

Does Microsoft or Windows provide a mechanism for access to a set of credentials, where I cannot just save the salted version of the password; namely, I need to have the password itself.

I have a web service that responds to requests, where if the user is authenticated and belongs to the mailing list, the task must be run on a unix machine using a unix account. I use the fantastic ssh.net library to remotely access a web service on a linux machine and run the required process, but until then, I save the password for the unix account in the configuration file as plain text (yikes)

What are my options here? I thought I could encrypt and decrypt the password, but the key will also be saved in the configuration file, so not much.

Does Windows have a keystore that can be accessed with the proper account service? Are there other authentication methods on Linux that do not require a password?

Answer 1

You can encrypt the configuration sections of your configuration file. Check out this article:

http://msdn.microsoft.com/en-us/library/vstudio/zhhddkxy (v = vs .100) .aspx

or this

http://weblogs.asp.net/jongalloway/encrypting-passwords-in-a-net-app-config-file

or this

http://www.codeproject.com/Articles/20398/Encrypt-and-Decrypt-ConnectionString-in-app-config