Edit

Update passwords

This guide describes the process of passwords update for the installed Workfusion Intelligent Automation Cloud product. We assume that "passwords" are any settings specified in config.yml file before installation.

This guide may be useful in the following cases:

• Workfusion Intelligent Automation Cloud was initially installed with weak passwords, and you want to update some or all of them.
• You have a password rotation policy in your organization, which requires regular passwords update.

Predefined common variables:

• WFUSER – the WorkFusion user. By default, WFUSER
• <installation-user> – a user that was created for Intelligent Automation Cloud installation. By default, ec2-user
• INSTALL_DIR – the WorkFusion home directory. By default, /opt/workfusion
• PACKAGE_DIR – the WorkFusion installer directory. By default, /opt/workfusion/wf_installer

Once you have begun to update passwords, make sure to finish it on all servers. Otherwise, your product will not be operational. If you changed database usernames, it is up to you to remove previous users manually, if needed, for example, any INT users.

important

Remeber to run the following steps as <installation-user>.

To update passwords:

1. On the INT server, in config.yml, change the required passwords:

   $ cd PACKAGE_DIR
   $ ./install.sh edit_config int # open for editing
   

   Note: You can use the following steps both to update your passwords and the vault certificates.

2. If you have changed passwords for any certificate, remove the appropriate certificates and re-generate them, as described in article Prepare TLS certificates for installation.

   Example...

   • If you have changed the following lines in config.yml:

     vault_admin_cert_pass
     vault_client_cert_pass
     

     re-generate all vault certificates:

     -rw-rw-r--. 1 ec2-user ec2-user 1298 Jun  3 12:15 vault_admin.crt
     -rw-rw-r--. 1 ec2-user ec2-user 2517 Jun  3 12:15 vault_admin.p12
     -rw-rw-r--. 1 ec2-user ec2-user 1298 Jun  3 12:15 vault_workfusion.crt
     -rw-rw-r--. 1 ec2-user ec2-user 2517 Jun  3 12:15 vault_workfusion.p12
     

   • If you have changed the following lines in config.yml,

     ca_key_pass
     

     re-generate the following certificates:

     -rw-rw-r--. 1 ec2-user ec2-user 1424 Jun  3 12:15 elk-ca.crt
     -rw-rw-r--. 1 ec2-user ec2-user 1766 Jun  3 12:15 elk-ca.key
     -rw-rw-r--. 1 ec2-user ec2-user 1757 Jun  3 12:15 kibana.crt
     -rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:15 kibana.key
     -rw-rw-r--. 1 ec2-user ec2-user 1761 Jun  3 12:15 logstash.crt
     -rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:15 logstash.key
     -rw-rw-r--. 1 ec2-user ec2-user 1428 Jun  3 12:49 mtls-ca.crt
     -rw-rw-r--. 1 ec2-user ec2-user 1766 Jun  3 12:49 mtls-ca.key
     -rw-rw-r--. 1 ec2-user ec2-user 1769 Jun  3 12:49 mtls-client.crt
     -rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:49 mtls-client.key
     

   • If you have changed the following lines in config.yml

     elk_logstash_certificate_pass
     

     re-generate the logstash.p12 package:

     -rw-rw-r--. 1 ec2-user ec2-user 4013 Jun 3 12:15 logstash.p12
     

3. Update the passwords depending on your installation approach:

   • Single-point setup:

     Update passwords on all servers in the following order: INT > BEP Master > BEP Agents > APP > OCR (Linux).

     For that, run the following commands:

     $ export ANSIBLE_PRIVATE_KEY_FILE="<path-to-private-linux-installation-key>"
     $ export ANSIBLE_REMOTE_USER="<installation-user>"
     $ cd PACKAGE_DIR
     $ ./install.sh configure <server_role>
     

     Replace <server_role> with the respective server role. Supported values: int, bep-master, bep-agent, app, ocr.

   • Legacy setup:

     1. Copy the newly generated certificates (see step 2) and the config.yml file from the initial installation directory on the INT server to all other Linux servers (BEP Master, BEP Agents, APP, OCR (Linux).) to the same locations, as on the INT server.

     2. Update passwords locally on all other servers in the following order: INT > BEP Master > BEP Agents > APP > OCR (Linux).

        $ cd PACKAGE_DIR
        $ ./install.sh configure <server_role>
        

        Replace <server_role> with the respective server role. Supported values: int, bep-master, bep-agent, app, ocr

   As a result, the new passwords and Vault certs (if they have been re-generated) are applied.

note

If you have re-generated any other certificates, except Vault, you need to complete updating them, as described in Update TLS certificates (step

3).

Note that the following parameters can only be specified before the installation and can't be changed later.

• wf_tableau_automation_username
• wf_tableau_automation_password
• wf_tableau_dashboard_username
• wf_tableau_dashboard_password