Encrypting Passwords with Cipher Tool

The secure vault cipher tool enables you to encrypt passwords to improve security.

1. Make sure the ciphertool.sh (Linux) or ciphertool.bat (Windows) file is accessible in your product's bin folder.
2. This sample is based on the XML configuration file called rss­-config.xml file which has two passwords called “rssadmin” and “root”.
3. Edit cipher configurations. The cipher related configurations are located in the following location in product: wso2­product/repository/conf/security/. The two configuration files that need to be edited are cipher­-text.properties and cipher-­tool.properties.

4. Add the following lines to the cipher­-tool.properties file.

   #rss­config.xml xpaths
   RSSConfiguration.DEFAULT.WSO2RSS1.Password=rss-config.xml//RSSConfiguration/Environments/Environment[Name='DEFAULT']/RSSInstances/RSSInstance[Name='WSO2RSS1']/DataSourceConfiguration/Definition/Password,true

   Mention the file name and the XPath of the XML element which describes the password. Also encrypt the password for each password separately by comma separated false (,false).

5. Add the following lines to the cipher­-text.properties file.
   

   #rss­config.xml passwords
   RSSConfiguration.DEFAULT.WSO2RSS1.Password=[root]

   You can see the default password for the Carbon product is “wso2carbon”.

6. Apply the real password and encrypt it. To do this, open a terminal and navigate to your product's bin folder and enter the following command:
   

   sh ciphertool.sh -­Dconfigure

7. Enter the default password which is “wso2carbon” (,wso2carbon). 

8. You can now see encrypted passwords in the cipher-­text.properies file. 

   RSSConfiguration.DEFAULT.WSO2RSS1.Password=g74ozaONxaLh57rQPlBmmBzL0AnL7tcgUFCHu2OMmIgfK1SZKmRD2GGzIPdkfZQ2sa+iCI8wpOOx\n8ZRX5CeXcNxw
   N8EdBHPzHkpGkCtzq5u4L2M9KWDmHXg9QXLVeCT+b76NE1iT8jlG7vCeTuw6Ms//\ngZGVgvHxacuGdRyPIVg\=