Encrypting system resources
Encrypt data in the system.batchlog and system.paxos tables, hint files, and commit logs using a local encryption key.
|
If tracing is enabled, the system_traces keyspace also contains sensitive data; encrypt tables in the system_traces keyspace following the instructions in Encrypting tables. |
Prerequisites
Complete the key setup described in Setting up local encryption keys.
|
When using a local encryption key file, set the location |
Procedure
-
In the dse.yaml file, configure encryption settings for system tables, the commit log, and the hints files.
system_info_encryption: enabled: true cipher_algorithm: <cipher_name> secret_key_strength: <key_length> chunk_length_kb: <default_table_chunk_size>
-
Required. Set
enabledto true. -
Optional. Configure the type of encryption key to use:
-
cipher_algorithm: Set the name of a supported JCE cipher algorithm to use. For a list of support algorithms, seecipher_algorithmin dse.yaml: -
secret_key_strength: Specify the key length. -
chunk_length_kb: Size of SSTables. The default (64) is used if the option is excluded. When these properties are set, DSE only uses a key that matches; if no matching key exists, start up fails.
-
-
-
To encrypt existing data, run
nodetool upgradesstables -a system batchlog paxoson all nodes in the cluster.
