Encrypting sensitive configuration values
Configuration encryption provides privacy and increased security for sensitive configuration values such as passwords.
opscenterd.conf
The location of the opscenterd.conf file depends on the type of installation:
-
Package installations: /etc/opscenter/opscenterd.conf
-
Tarball installations: install_location/conf/opscenterd.conf
cluster_name.conf
The location of the cluster_name.conf file depends on the type of installation:
-
Package installations: /etc/opscenter/clusters/cluster_name.conf
-
Tarball installations: install_location/conf/clusters/cluster_name.conf
address.yaml
The location of the address.yaml file depends on the type of installation:
-
Package installations: /var/lib/datastax-agent/conf/address.yaml
-
Tarball installations: install_location/conf/address.yaml
Activate configuration encryption for privacy and increased security for sensitive configuration values such as passwords. Sensitive configuration values entered within the OpsCenter user interface are encrypted dynamically, then transmitted and written in an encrypted state to the relevant configuration files.
Manually editing configuration files requires manually encrypting the value and copying it to the appropriate location. Use the OpsCenter system key tool to manually encrypt configuration values.
|
Credentials used to access existing destinations for scheduled backups must be encrypted manually.
For example, you must manually encrypt the |
System encryption key
The OpsCenter system key tool allows creating a key used for encryption on the opscenterd machine and all the nodes in a cluster. The system key tool resides in the /bin directory of opscenterd, such as /usr/share/opscenter/bin. Decrypting values is not supported.
| AES encryption modes (cipher algorithm) | Key strengths |
|---|---|
ECB |
128- or 256-bit |
CBC |
128- or 256-bit |
CFB |
128- or 256-bit |
OFB |
128- or 256-bit |
|
Using 256-bit key strength requires upgrading the JRE with enhanced security jar files.
Download and install the Java Cryptography Extension (JCE), unzip the jar files, and place them under |
Encrypted fields
When configuration encryption is active in OpsCenter, any sensitive configuration values in the OpsCenter UI that are required to be encrypted are encrypted automatically by OpsCenter. The majority of sensitive configuration values can only be changed by directly editing the appropriate configuration file with the manually-encrypted configuration value.
cluster_name.conf
The cluster configuration cluster_name.conf fields that require encryption include:
-
[jmx]:password -
[cassandra]:password,ssl_keystore_password,ssl_truststore_password -
[storage_cassandra]:password,ssl_keystore_password,ssl_truststore_password -
[agents]:ssl_keystore_passwordandssl_truststore_password(monitored cluster),storage_ssl_keystore_password,storage_ssl_truststore_password(separate storage cluster) -
[agent_kerberos]:keytab,ticket_cache -
[backup_service]:s3_proxy_host,s3_proxy_port
email.conf
The following fields in email.conf require encryption:
-
smtp_pass
This file is located in install_location/event-plugins/email.conf.
Encryption for the smtp_pass field must be manually enabled.
opscenterd.conf
The opscenterd.conf fields that require encryption include:
-
[ldap]:search_password
address.yaml
You are not required to configure the following DataStax Agent configuration fields in address.yaml. OpsCenter provides the values from opscenterd.conf to the DataStax Agents when it connects.
|
If you set the DataStax Agent configuration fields values in address.yaml and set The DataStax Agent configuration fields in address.yaml that require encryption include:
|
