Pearl1594 opened a new pull request #5459: URL: https://github.com/apache/cloudstack/pull/5459
### Description This PR addresses: https://github.com/apache/cloudstack/issues/4293 - facilitates a means to use encrypted password for `https.keystore.password` in `server.properties` <!--- Describe your changes in DETAIL - And how has behaviour functionally changed. --> <!-- For new features, provide link to FS, dev ML discussion etc. --> <!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. --> <!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged --> <!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" --> <!-- Fixes: # --> <!--- ********************************************************************************* --> <!--- NOTE: AUTOMATATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE DOCUMENTATION. --> <!--- PLEASE PUT AN 'X' in only **ONE** box --> <!--- ********************************************************************************* --> ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [ ] Bug fix (non-breaking change which fixes an issue) - [X] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) ### Feature/Enhancement Scale or Bug Severity #### Feature/Enhancement Scale - [ ] Major - [X] Minor ### How Has This Been Tested? Based On (temporary) logs added: #### Without Encryption: With following values in server.properties: ``` # The keystore and manager passwords are assumed to be same. https.keystore=/etc/cloudstack/management/cloud.jks https.keystore.password=vmops.com #db.cloud.encryption.type=file #https.keystore.password=ENC(8dvrsq9w5QxOH8G61QCOaW3XeO1j5jD1) ``` On restarting MS - following logs were seen: ``` 2021-09-16 08:30:49,425 INFO [o.a.c.ServerDaemon] (main:null) (logid:) Server configuration file found: /etc/cloudstack/management/server.properties 2021-09-16 08:30:49,437 DEBUG [c.c.u.c.EncryptionSecretKeyChecker] (main:null) (logid:) Encryption Type: null 2021-09-16 08:30:49,441 INFO [o.a.c.ServerDaemon] (main:null) (logid:) http_pass: vmops.com ``` #### With Encryption: server.properties content for keystore password: ``` # The keystore and manager passwords are assumed to be same. https.keystore=/etc/cloudstack/management/cloud.jks db.cloud.encryption.type=file https.keystore.password=ENC(8dvrsq9w5QxOH8G61QCOaW3XeO1j5jD1) ``` On restarting MS: ``` 2021-09-16 08:35:29,182 INFO [o.a.c.ServerDaemon] (main:null) (logid:) Server configuration file found: /etc/cloudstack/management/server.properties 2021-09-16 08:35:29,193 DEBUG [c.c.u.c.EncryptionSecretKeyChecker] (main:null) (logid:) Encryption Type: file 2021-09-16 08:35:29,267 INFO [o.a.c.ServerDaemon] (main:null) (logid:) http_pass: vmops23.com ``` Steps followed to encrypt the password for https.keystore.password: ``` [root@ref-trl-1789-k-M7-pearl-dsilva-mgmt1 ~]# java -classpath /usr/share/cloudstack-common/lib/jasypt-1.9.3.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI encrypt.sh input="vmops23.com" password="`cat /etc/cloudstack/management/key`" verbose=true ----ENVIRONMENT----------------- Runtime: Red Hat, Inc. OpenJDK 64-Bit Server VM 11.0.12+7-LTS ----ARGUMENTS------------------- input: vmops23.com password: password verbose: true ----OUTPUT---------------------- 8dvrsq9w5QxOH8G61QCOaW3XeO1j5jD1 ``` <!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md) document --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
