by dan
5. November 2009 11:31
Whenever you check the SQL Databases for AxCMS.net, you will wonder that all passwords are stored in clear text by default.
As this should be no option for productive systems there is an fairly unknown security option described in the AxCMS.net help files:
- EncryptPasswordsMS
This option will encrypt all passwords on management system if set to 1
- EncryptPasswordsLive
This option will encrypt all passwords on live system if set to 1
Both options need to be defined in the web.config files: the MS web.config has to define both entries, while the LS web.config only has to state the EncryptPasswordsLive key.
The only thing I wonder about: If we have such a fine configuration that enables a higher security level at absolutely no costs: Why isn´t it set in default web.config files?
Subscribe