Set up local encryption keys for production environments
After installing HCD, create a local encryption key file, distribute it to the same location on all nodes in the cluster, and update the cassandra.yaml system_key_directory property.
The location of the cassandra.yaml file depends on your installation type.
-
Package installations:
/etc/hcd/cassandra/cassandra.yaml -
Tarball installations:
INSTALLATION_LOCATION/resources/cassandra/conf/cassandra.yaml
Prerequisites
To ensure support for all encryption algorithms, enable JCE.
|
Starting in |
Procedure
-
If the directory does not exist, create the
/confdirectory for your HCD installation type:-
Package installations
/etc/hcd/conf -
Tarball installations
INSTALLATION_LOCATION/resources/hcd/confReplace
INSTALLATION_LOCATIONwith the installation location.
-
-
Generate the encryption key file:
echo -n "$(openssl rand -hex 32)" > /etc/hcd/conf/system_key -
Ensure that the HCD user has read and write access on the file. If necessary, change the ownership of the file to the HCD user.
chown cassandra /etc/hcd/conf/system_key
