Update passwords

This guide describes the process of passwords update for the installed Workfusion Intelligent Automation Cloud Enterprise v10.1.4.0.

The guide may be useful in the following cases:

Workfusion Intelligent Automation Cloud Enterprise was initially installed with weak passwords, and you want to update some or all of them.
You have a password rotation policy in your organization, which requires regular passwords update.

The passwords-update procedure is devided into several stages:

Stop all running business-processes in Control Tower.
Stop all product services.
Destroy workers and cleanup rabbitmq queues.
Update config.yml on the APP server with new passwords.
Re-encrypt config.yml on the APP server.
Generate new Vault and Logstash certificates.
Copy new config.yml and new certificates from APP server to all other linux servers.
Update user credentials on RPA Server.
Update user credentials on OCRWin Server (If your OCR platform is Windows).
Update user credentials on BI Server.
Update MS SQL logins credentials.
Apply configuration.
Run environment health-check.

important

Once you have begun to update passwords, make sure to finish it on all servers. Otherwise, your product will not be operational.

Prepare for changing passwords

In your browser, log in Control Tower, and stop any running business processes.
Stop all product services (except BI):
- For single-point installation:
  
  On the APP server, adjust variables for your environment and execute as <linux_installation_user> :
```
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
$ export ANSIBLE_REMOTE_USER='current-user'
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
$
$ cd $PACKAGE_DIR
$ ./install.sh stop_services full -e skip_bi=true
```
- For multi-point installation:
  
  On each Linux server (in the following order: OCR -> BEP-AGENT -> BEP-MASTER -> APP -> INT) execute as <wf_user>:
```
   ```bash
     $ wfmanager stop all
   ```
```
If your environment is deployed in HA mode, and has multiple remember to execute the command on each server.

To destroy workers, on each BEP-AGENT server, execute as <wf_user>:

$ pkill -f worker.jar
$
$ # check that there are no running worker processes:
$ ps aux | grep 'worker.jar'

To clean the rabbitmq queues up, on the INT server, execute as <wf_user>:

$ wfmanager start rabbitmq
$ rabbitmqctl list_queues --vhost bep | awk '{ print $1 }' | xargs -L1 rabbitmqctl delete_queue --vhost bep
$ wfmanager stop rabbitmq

For the high-availability mode, first start rabbitmq on each INT server, then execute the rabbitmqctl command for cleanup, and finally stop rabbitmq.

Update passwords in config.yml

Under passwords we assume settings which you specify in ****config.yml**** file before product installation.

The config.yml file itself is not the source of settings from which product components read their configuration. Thus, changing of passwords in config.yml and saving the file does not update the passwords used by product components on different servers of the environment.

config.yml is the aggregated config file which you normally fill before product installation, and it is used only by installer to read the provided desired settings and save them to various destinations (places where configuration is stored while product is running) during deployment. The destinations for settings may vary, and the names of settings in the destinations may differ from settings names in config.yml. Many same identities appear in multiple places on multiple servers during deployment, and are intended for different purposes. It all depends on how various product components are implemented to read their configuration. For example, if you change s3_access_key in config.yml it means that not only minio-server (s3 emulator) configuration will be updated but also configuration of several other product components which require communication with minio. The same applies to many other settings.

Here is the list of possible destinations where the settings from config.yml are get stored by installer during deployment:

Hashicorp Vault (The main "key-value" secret storage embedded into the product). Most of the product services read their configuration from hashicorp Vault API on initialization of processes;
Various files on the file systems on different servers of the environment (i.e. Nexus stores its credentials in encrypted form in xml file, or minio-server reads s3 keys from environment variables passed to the process in startup script);
zookeeper nodes (Another "key-value" storage used by many product components);

To update passwords in config.yml:

On the APP server, backup your current config.yml:

$ cd PACKAGE_DIR
$ cp config.yml config_yml_bak

Edit config.yml and change the required passwords:

$ ./install.sh edit_config app

You will be prompted to enter your current <ansible_vault_password>.

Below is the full list of passwords which you might want to update. Update the desired settings and save the file.

ansible_vault_password

s3_access_key
s3_secret_key
wf_username
wf_password
java_cacerts_truststore_pass
marathon_web_pass
mesos_web_pass
rabbitmq_ocr_pass
rabbitmq_bep_pass
rabbitmq_admin_pass
elk_admin_pass
elk_elastic_pass
elk_kibana_pass
wf_sso_saml_metadata_admin_user
wf_sso_saml_metadata_admin_pass
nexus_admin_pass
tableau_dashboard_user
tableau_dashboard_pass
tableau_admin_user
tableau_admin_pass
ocr_sec_pass
ocr_jwt_secret
workspace_root_requester_pass
bot_manager_jwt_secret
rpa_bot_manager_pass

mail_user
mail_pass

vault_admin_cert_pass
vault_client_cert_pass
elk_logstash_certificate_pass

ocrwin_user
ocrwin_pass

bi_user
bi_pass

rpa_user
rpa_pass

bot_master_user_name
bot_master_user_pass
bot_unit_base_name
bot_unit_pass

mssql_dba_user
mssql_dba_pass
mssql_ct_user
mssql_ct_pass
mssql_ws_user
mssql_ws_pass
mssql_sqc_user
mssql_sqc_pass
mssql_ds_user
mssql_ds_pass
mssql_rpa_user
mssql_rpa_pass
mssql_pm_user
mssql_pm_pass
mssql_dm_user
mssql_dm_pass
mssql_rapi_user
mssql_rapi_pass
mssql_ocr_user
mssql_ocr_pass
mssql_automl_mms_user
mssql_automl_mms_pass

On the APP server, re-encrypt config.yml:

Perform this step only if you have updated ansible_vault_password in config.yml.

To re-encrypt config.yml with new password, run the following command:
```
$ ./install.sh rekey config
```
You will be prompted to enter your OLD ansible vault password. After command execution, config.yml becomes encrypted with new password which you specified during editing.

Generate new Vault and Logstash certificates.

important

Perform this step ONLY if you have updated one of the following settings config.yml:

vault_admin_cert_pass
vault_client_cert_pass
elk_logstash_certificate_pass

To generate new Vault and Logstash certificates, on the APP server, execute the commands as <linux_installation_user>:

$ rm -rf ./certificates/_auth_internal/vault*
$ rm -rf ./certificates/_auth_internal/logstash*
$ ./install.sh certs generate

After execution, the new vault and logstash certificates are generated, and their private keys are protected by your new passwords:

./certificates/_auth_internal/logstash.crt
./certificates/_auth_internal/logstash.key
./certificates/_auth_internal/logstash.p12
./certificates/_auth_internal/vault_admin.crt
./certificates/_auth_internal/vault_admin.p12
./certificates/_auth_internal/vault_workfusion.crt
./certificates/_auth_internal/vault_workfusion.p12

Distribute updated configuration and certificates across servers

important

Perform this step only for the multi-point installation type.

To copy config.yml and certificates from the APP server, use any convinient method of file transferring between Linux machines.

In this example we will use file sharing over HTTP from the APP server.

On the APP server, ensure that you are located in PACKAGE_DIR (directory where installer is extracted), and execute:
```
$ cd PACKAGE_DIR
$ python -m SimpleHTTPServer 8443
# Output:
Serving HTTP on 0.0.0.0 port 8443 ...
```
This will make files in PACKAGE_DIR on the APP server downloadable from other servers. Ensure that the port which you've chosen is accessible on the APP server (not blocked by firewalls) from other Linux servers.

On all other Linux hosts (INT, BEP-MASTER, BEP-AGENT, OCR), change the PACKAGE_DIR and APP_HOSTNMAME variables, and run the commands as <linux_installation_user>:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export APP_HOSTNAME=app.example.com

$ cd $PACKAGE_DIR
$ curl -o 'config.yml' http://$APP_HOSTNAME:8443/config.yml
$ curl -o './certificates/_auth_internal/vault_admin.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_admin.crt
$ curl -o './certificates/_auth_internal/vault_admin.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_admin.p12
$ curl -o './certificates/_auth_internal/vault_workfusion.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.crt
$ curl -o './certificates/_auth_internal/vault_workfusion.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.p12
$ curl -o './certificates/_auth_internal/logstash.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.crt
$ curl -o './certificates/_auth_internal/logstash.key' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.key
$ curl -o './certificates/_auth_internal/logstash.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.p12

Copy the vault_workfusion.p12 certificate from the APP server to the RPA and OCRWin servers (if Windows based OCR is used).

on RPA server, run Powershell as Administrator, and execute the following commands:

$rpa_install_dir  = 'C:\RPA'  # RPA Installation Directory on this server
$download_from = "app.example.com:8443"  # Hostname of APP server and port on which files are shared

# Downloading vault_workfusion.p12 from APP server and saving it as workfusion.p12 file in ${rpa_install_dir}\bot-agent\ssl\ directory
$wc = New-Object net.webclient
$wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\bot-agent\ssl\workfusion.p12")

If your OCR platform is Windows, on the OCRWin server, run Powershell as Administrator, and execute the following commands:

$ocr_install_dir  = 'C:\workfusion'   # OCR Installation Directory on this server
$download_from = "rcm-4200-ha-wfan-10024-ct1.workfusion.com:8443"

# Downloading vault_workfusion.p12 from APP server and saving it as workfusion.p12 file in ${ocr_install_dir}\vault\shared_auth\ directory
$wc = New-Object net.webclient
$wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${ocr_install_dir}\vault\shared_auth\workfusion.p12")

Also, if you haven't removed the OCRWin installer from the Windows server, go to the directory where Windows OCR Installer was extracted, edit ocr_config.ini file, and change the vault_workfusion_cert_pass setting with the same value, as you specified in config.yml for vault_client_cert_pass.

On the APP server, stop file sharing by pressing "Ctrl+C".

Update user credentials on RPA Server

important

Perform this step only if you changed any of RPA users credentials in config.yml.

If you changed any of the following settings in config.yml, update the RPA Windows users respectively:

rpa_user
rpa_pass

bot_master_user_name
bot_master_user_pass
bot_unit_base_name
bot_unit_pass

Preparation of Windows users is a part of installation prerequisites, so it is up to you to update them now if it is what you wish. The users may be Active directory users, or local Windows users. If you're using local Windows users and decided to changed only passwords, navigate on RPA server to "Computer Management -> Local Users and Groups -> Users -> right-click some user -> Set Password".

For multi-point installation rpa_user and rpa_pass are not used. They are used only by installer in single-point installation to connect to RPA server and execute commands remotely. Basically, in multi-point installation rpa_user represents user which you would use to login via RDP into RPA machine.

Only bot_master_user and bot_unit users take part in product execution.

Update user credentials on OCRWin Server

important

You need to do this step only if all three conditions are met:

your OCR platform is Windows;
you use single-point installation;
you updated ocrwin_user or ocrwin_pass in config.yml.

This user is used only in single-point installation by ansible installer to connect with WinRM to OCRWin server and execute commands remotely.

Update user credentials on BI Server

important

You need to do this step only if you're updating BI-related passwords:

bi_user
bi_pass

tableau_dashboard_user
tableau_dashboard_pass
tableau_admin_user
tableau_admin_pass

You need to update bi_user on BI server only for single-point installation. It's normal windows user which is used only by ansible installer to connect ot BI server and execute commands remotely. It doesn't take part in product execution after installation is finished. It's the user which you use to connect via RDP to BI server.

If you changed tableau_dashboard_pass or tableau_admin_pass, you need to login into Tableau using browser under your current tableau admin user.

Then navigate to "Users" tab -> click on desired user -> click "Settings" tab -> "Change Password".

For HA mode, you need to start your standby BI server, login there with browser (using direct bi_hostname of standby BI server), and perform the same.

Update MS SQL logins credentials

important

You need to do this step only if you're updating any of MS SQL users:

mssql_dba_user
mssql_dba_pass
mssql_ct_user
mssql_ct_pass
mssql_ws_user
mssql_ws_pass
mssql_sqc_user
mssql_sqc_pass
mssql_ds_user
mssql_ds_pass
mssql_rpa_user
mssql_rpa_pass
mssql_pm_user
mssql_pm_pass
mssql_dm_user
mssql_dm_pass
mssql_rapi_user
mssql_rapi_pass
mssql_ocr_user
mssql_ocr_pass
mssql_automl_mms_user
mssql_automl_mms_pass

Connect to your MS SQL server with MS SQL Management Studio under admin user (should have at least "securityadmin" server role), and update passwords for MS SQL logins. If you updated not only passwords but also usernames it is up to you to create new MS SQL logins and remove old ones on the side of MS SQL server.

Apply configuration

For single-point mode

To apply configuration, on the APP server, run the followng commands:

```bash
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
$ export ANSIBLE_REMOTE_USER='current-user'
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
$
$ cd $PACKAGE_DIR
$ ./install.sh precheck mssql
$ ./install.sh configure mssql
$ ./install.sh configure full
```

For multi-point installation

To apply configuration:

On the APP server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh precheck mssql -c local
$ ./install.sh configure mssql -c local
$ ./install.sh install lb -c local --limit <current_hostnmame>

On the INT server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh install int -c local --limit <current_hostnmame>

On the BEP MASTER server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh install bep-master -c local --limit <current_hostnmame>

On the BEP AGENT server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh install bep-agent -c local --limit <current_hostnmame>

On the APP server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh install app -c local --limit <current_hostnmame>

On the OCR server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh install ocr -c local --limit <current_hostnmame>

To push OCRWin configs to Zookeeper and Vault, on the APP server, run the commands (only if Windows OCR is used):

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh configure ocrwin -c local --limit <current_hostnmame>

Reboot RPA, BI, and OCRWin (if applicable) servers.

Run environment health-check

To check environment:

Wait for environment stabilization after startup of services for about 5-7 minutes.

On the APP server, run the command:

$ ./install.sh check app -c local --limit <current_hostnmame> -e test_ml=true -e test_rpa=true -e test_ie=true -e test_desktop=true -e test_ocr=true

WorkFusion Documentation

10.1.4

Hardware

High availability setup

Standard setup

Install Linux components

Install OCR Windows server

Logs management

Security settings in Control Tower

important

Prepare for changing passwords

Update passwords in config.yml

Generate new Vault and Logstash certificates.

important

Distribute updated configuration and certificates across servers

important

Update user credentials on RPA Server

important

Update user credentials on OCRWin Server

important

Update user credentials on BI Server

important

Update MS SQL logins credentials

important

Apply configuration

For single-point mode

For multi-point installation

Run environment health-check