JBoss EAP 6/7 - vault : 패스워드 암호화

1. keystore/vault 파일을 저장할 디렉터리 생성

web1]$ mkdir -p $JBOSS_HOME/vault

 

 

2. keystore.sh 실행하여 keystore 생성

- 스크립트1. keysotre.sh 확인(맨아래)

web1]$ ./keystore.sh [aliasname] [storepass] [keypass] [validity(in day)]

 

 

3. vault.sh 실행하여 vault 생성

- 스크립트2. vault.sh 확인(맨아래)

web1]$ ./vault.sh [aliasname] [sotrepass] [password]

 

 

4. 출력된 결과를 standalone.xml / host-slave.xml / domain.xml에 등록

Please make note of the following:
********************************************
Vault Block:vb
Attribute Name:password
Configuration should be done as follows:
VAULT::vb::password::1
********************************************
WFLYSEC0048: Vault Configuration in WildFly configuration file:
********************************************
...
</extensions>
<vault>
  <vault-option name="KEYSTORE_URL" value="$JBOSS_HOME/vault/vault.keystore"/>
  <vault-option name="KEYSTORE_PASSWORD" value="MASK-5dOaAVafCSd"/>
  <vault-option name="KEYSTORE_ALIAS" value="vault"/>
  <vault-option name="SALT" value="1234abcd"/>
  <vault-option name="ITERATION_COUNT" value="120"/>
  <vault-option name="ENC_FILE_DIR" value="$JBOSS_HOME/vault/"/>
</vault>
<management>
...
********************************************

 

4.1. standalone 모드

web1]$ vi standalone.xml

...
</extensions>
<vault>

<vault-option name="KEYSTORE_URL" value="$JBOSS_HOME/vault/vault.keystore"/>
<vault-option name="KEYSTORE_PASSWORD" value="MASK-5dOaAVafCSd"/>
<vault-option name="KEYSTORE_ALIAS" value="vault"/>
<vault-option name="SALT" value="1234abcd"/>
<vault-option name="ITERATION_COUNT" value="120"/>
<vault-option name="ENC_FILE_DIR" value="$JBOSS_HOME/vault/"/>

</vault>
<management>
...

 

<datasource pool-name="OracleDS" ...>

<security>

<user-name>jboss</user-name>
<password>${VAULT::vb::password::1}</password>

</security>

</datasource>

 

4.2. domain 모드

web1]$ vi host-slave.xml

...
</extensions>
<vault>

<vault-option name="KEYSTORE_URL" value="$JBOSS_HOME/vault/vault.keystore"/>
<vault-option name="KEYSTORE_PASSWORD" value="MASK-5dOaAVafCSd"/>
<vault-option name="KEYSTORE_ALIAS" value="vault"/>
<vault-option name="SALT" value="1234abcd"/>
<vault-option name="ITERATION_COUNT" value="120"/>
<vault-option name="ENC_FILE_DIR" value="$JBOSS_HOME/vault/"/>

</vault>
<management>
...

 

web1]$ vi domain.xml

<datasource pool-name="OracleDS" ...>

<security>

<user-name>jboss</user-name>
<password>${VAULT::vb::password::1}</password>

</security>

</datasource>

 

 

5. 재기동

 

 

# 스크립트1. keystore.sh

#!/bin/sh

. ./env.sh

 

if[ \( -n "$1" \) -a \( -n "$2" \) -a \( -n "$3" \) -a \( -n "$4" \) ]
then

$JAVA_HOME/bin/keytool -genseckey -alias $1 -storetype jceks -keyalg AES -keysize 128 -storepass $2 -keypass $3 -validity $4 -keystore $JBOSS_HOME/vault/vault.keystore
echo "Check: $JBOSS_HOME/vault/vault.keystore"
exit;

fi

echo "./keystore.sh [aliasname] [storepass] [keypass] [validity(in day)]"

exit;

 

# 스크립트2. vault.sh

#!/bin/sh

. ./env.sh

 

if[ \( -n "$1" \) -a \( -n "$2" \) -a \( -n "$3" \) ]
then

$JBOSS_HOME/bin/vault.sh --keystore $JBOSS_HOME/vault/vault.keystore --alias $1 --keystore-password $2 --vault-block vb --attribute password --sec-attr $3 --enc-dir $EAP_HOME/vault/ --iteration 120 --salt 1234abcd

echo "Check: $JBOSS_HOME/vault/VAULT.dat"

exit;

fi

echo "./vault.sh [aliasname] [storepass] [password]"

exit;

 

 

# 참고 URL : https://access.redhat.com/solutions/2790371