Ubuntu上的ASP.NET Core 2.2 Web应用程序 - 如何实现数据保护

Question

I've started using Ubuntu (18.04) to host some simple .NET Core 2.2 websites. And when the site is deployed and started I see the following:

warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[59] Neither user profile nor HKLM registry available. Using an ephemeral key repository. Protected data will be unavailable when application exits. warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35] No XML encryptor configured. Key {c45288a6-63f8-4408-abdb-7894fb6d4e45} may be persisted to storage in unencrypted form. Hosting environment: Production Content root path: /var/www/mysite Now listening on: http://localhost:5010 Application started. Press Ctrl+C to shut down. warn: Microsoft.AspNetCore.HttpsPolicy.HttpsRedirectionMiddleware[3] Failed to determine the https port for redirect.

So what is the best and secured way of implementing Key Storage Provider for Linux (and possibly for Windows too, universal)? Is there an existing one? Are there any examples?

PS. Yes, I've seen this docs - Key Storage Providers in ASP.NET Core .

Answer 1

The way we implemented this, supporting load balancing scenarios as well is by using Azure ATS as the key repository.

The configuration looks this way:

  string storageUrl = "https://[your account here].blob.core.windows.net";
  string sasToken = "?sv=20XX-XX-XX&ss=x&srt=xxx&sp=xxxx&...";
  string containerName = "data-protection-XXXX-XXXX-container";
  string blobName = "data-protection-XXXX-XXXX-blob";

   // Create the new Storage URI
   Uri storageUri = new Uri($"{storageUrl}{sasToken}");

   //Create the blob client object.
   CloudBlobClient blobClient = new CloudBlobClient(storageUri);

   //Get a reference to a container. Create it if it does not exist.
   CloudBlobContainer container = blobClient.GetContainerReference(containerName);

   // (NOTE: internal library, do not use in your code)
   AsyncHelper.Guarded<bool>(() => { return container.CreateIfNotExistsAsync();  });


   services.AddDataProtection()
        .SetApplicationName("[your application name here]")
        .PersistKeysToAzureBlobStorage(container, blobName)
        .SetDefaultKeyLifetime(new TimeSpan(365 * 10, 0, 0, 0, 0));

Note: Review the encryption options when configuring Data Protection for extra security.