Encrypting sensitive configuration values

Configuration encryption provides privacy and increased security for sensitive configuration values such as passwords.

address.yaml

The location of the address.yaml file depends on the type of installation:
  • Package installations: /var/lib/datastax-agent/conf/address.yaml
  • Tarball installations: install_location/conf/address.yaml

opscenterd.conf

The location of the opscenterd.conf file depends on the type of installation:
  • Package installations: /etc/opscenter/opscenterd.conf
  • Tarball installations: install_location/conf/opscenterd.conf

cluster_name.conf

The location of the cluster_name.conf file depends on the type of installation:
  • Package installations: /etc/opscenter/clusters/cluster_name.conf
  • Tarball installations: install_location/conf/clusters/cluster_name.conf

Activate configuration encryption for privacy and increased security for sensitive configuration values such as passwords. Sensitive configuration values entered within the OpsCenter user interface are encrypted dynamically, then transmitted and written in an encrypted state to the relevant configuration files.

Manually editing configuration files requires manually encrypting the value and copying it to the appropriate location. Use the OpsCenter system key tool to manually encrypt configuration values.

Note: Credentials used to access existing destinations for scheduled backups must be encrypted manually. For example, you must manually encrypt the access_secret field for any scheduled backups to Amazon S3.

System encryption key

The OpsCenter system key tool allows creating a key used for encryption on the opscenterd machine and all the nodes in a cluster. The system key tool resides in the /bin directory of opscenterd, such as /usr/share/opscenter/bin. Decrypting values is not supported.
Table 1. System key encryption modes and strengths
AES encryption modes (cipher algorithm) Key strengths
ECB 128- or 256-bit
CBC 128- or 256-bit
CFB 128- or 256-bit
OFB 128- or 256-bit
Note: Using 256-bit key strength requires upgrading the JRE with enhanced security jar files. Download and install the Java Cryptography Extension (JCE), unzip the jar files, and place them under $JAVA_HOME/jre/lib/security. JCE-based products are restricted for export to certain countries by the U.S. Export Administration Regulations.

Encrypted fields

When configuration encryption is active in OpsCenter, any sensitive configuration values in the OpsCenter UI that are required to be encrypted are encrypted automatically by OpsCenter. The majority of sensitive configuration values can only be changed by directly editing the appropriate configuration file with the manually-encrypted configuration value.

cluster_name.conf

The cluster configuration cluster_name.conf fields that require encryption include:

  • [jmx]: password
  • [cassandra]: password, ssl_keystore_password, ssl_truststore_password
  • [storage_cassandra]: password, ssl_keystore_password, ssl_truststore_password
  • [agents]: ssl_keystore_password and ssl_truststore_password (monitored cluster), storage_ssl_keystore_password, storage_ssl_truststore_password (separate storage cluster)
  • [agent_kerberos]: keytab, ticket_cache
  • [backup_service]: s3_proxy_host, s3_proxy_port

email.conf

The following fields in email.conf require encryption:

  • smtp_pass

This file is located in install_location/event-plugins/email.conf. Encryption for the smtp_pass field must be manually enabled.

opscenterd.conf

The opscenterd.conf fields that require encryption include:

  • [ldap]: search_password

address.yaml

You are not required to configure the following DataStax Agent configuration fields in address.yaml. OpsCenter provides the values from opscenterd.conf to the DataStax Agents when it connects.
Important: If you set the DataStax Agent configuration fields values in address.yaml and set config_encryption_active to true in address.yaml in addition to opscenterd.conf, you must supply the encrypted values for those fields.
The DataStax Agent configuration fields in address.yaml that require encryption include:
  • access_secret
  • storage_key
  • jmx_pass
  • cassandra_pass
  • monitored_cassandra_pass
  • ssl_keystore_password (storage cluster)
  • ssl_truststore_password (storage cluster)
  • monitored_ssl_keystore_password (monitored cluster)
  • monitored_ssl_truststore_password (monitored cluster)