please take a look at security

[grzjoh48]

of default passwords

sa

autodeskvault

vaultsys

all default passwords and in cleartext in web.conf

[ihayesjr]

Thank you for posting this idea. The SA password is not stored in the web.config file. If it is not the default, the console will prompt for the correct password.

[grzjoh48]

hi irvin,

yeah, but vaultsys who is sysadmin on the sql server is in the webconfig.

br

hannes

[clastrilla]

There is also an issue when using non-default SA passwords and using a backup script (connectivity.ADMSconsole). The SA password is exposed in the backup script in plain text - which is a security issue.

[hcarruthers]

We need a method to address many companies’ corporate security policies for the MS SQL account passwords used by Vault. Currently the published passwords and locations for the MS SQL Accounts for "sa" and "VaultSys" are creating security compliancy issues because the passwords are available in “clear text” either within the command line script files for processes like a Vault backup, or in the Web configuration files that use the “VaultSys” account.

To address the “sa” password there are several workflows available ranging from using 3rd party backup tools for the Vault to creating encrypted script files.

However there does not seem to be any workflows to address the need for encrypting the password required for the “VaultSys” account. The "VaultSys" account password can be changed using SQL Server Management Studio, however, it must also then be changed in the Web.config file, which results in the password being stored in “clear text” and violates the companies' security policies.

What is needed is a simple (cost effective) method for Vault and MS SQL Administrators to establish secure passwords for these MS SQL accounts that are not stored or used in any “clear text” format. Ideally the unique passwords could be established during the initial installation of the Vault Server and then managed through the ADMS console or through a separate Vault utility.

[thaase]

From a customer to a new idea.

Fact:

Vault uses 3 SQL users: sa, VaultSys and [YourServer]\AutodeskVault.

Of all 3 Users, you will find the password in the web.config on the server in 

C:\Program Files\Autodesk\ADMS Professional [Year]\Server\Web\Services

or you use Google to find the rest of it.

Problem:

Some customers have very strict security policies for software. Like military and airspace

No Default Passwords, change every 14 days .....

But when you want to change ist, there is no guide for the workaround. But this is a other problem.

When a person want to do some big damage, he can find every password in the web.config

Solution:

Encrypt the password information in the web.config.

Whitepaper for Autodeskpartners "How to change the password of all Vault generated users"

In my opinion, if someone is possible to log on your Vault Server or SQL Server, you have a great security problem.

But some customers have very strict security policies and you must argue a lot about this before they trust you.

[ian.lowe]

We have exactly this problem, its not acceptable in our security standards to have clear text passwords in config files whatever the file security settings. I would like to add my vote that this needs to be updated. I am having to report a non-compliant application in our documentation even though the system has just been installed. I logged a ticket and was asked to post here.

[MattiasWiik]

If you look at the web.config all passwords are written in clear text. This is a potential security risk as if anyone breaks into the server and get a hold of this file they can potentially extract data out of the Vault with these accounts. We have a few add-ins for Vault that have an encryption algorithm to read the passwords from the configuration file instead of having them in clear text so I know it is possible.