Update passwords

This guide describes the process of passwords update for the installed Workfusion Intelligent Automation Cloud Enterprise v10.1.6.

The guide may be useful in the following cases:

Workfusion Intelligent Automation Cloud Enterprise was initially installed with weak passwords, and you want to update some or all of them.
You have a password rotation policy in your organization, which requires regular passwords update.

The passwords-update procedure comprises of the following stages:

Stop all running business-processes in Control Tower.
Stop all product services.
Destroy workers and cleanup rabbitmq queues.
Update config.yml and rpa.yml on the APP server with new passwords.
Re-encrypt config.yml and rpa.yml on the APP server.
Generate new Vault and Logstash certificates.
Copy new config.yml and certificates from APP to all other Linux servers.
Update user credentials on RPA Server.
Update user credentials on OCRWin Server (If your OCR platform is Windows).
Update user credentials on BI Server.
Update MS SQL logins credentials.
Apply configuration.
Run environment health-check.

important

Once you start to update passwords, make sure to finish it on all servers. Otherwise, your product will not be operational.

Prepare installer

To prepare the installer:

Ensure that the last line of PACKAGE_DIR/roles/failover/tasks/main.yml has value configure in the tags list:
```
  tags: [configure, install]
```

Ensure that - include_tasks: install.yml in PACKAGE_DIR/roles/init-common/tasks/main.yml has value configure in the tags list:

- include_tasks: install.yml
  tags:
    - install
    - update_certs
    - update_artifacts
    - migrate
    - configure

important

If you have performed a multi-point installation, execute the steps above on each Linux server.

Prepare environment

To prepare the environment:

In your browser, log in Control Tower, and stop any running business processes.
Stop all product services (except BI):

Single-point setup

Multi-point setup

On the APP server, adjust variables for your environment and execute the commands as <linux_installation_user> :

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh stop_services full -e skip_bi=true

On each Linux server (in the following order: OCR -> BEP Agent -> APP), execute as <wf_user>:

$ wfmanager stop all

To destroy workers, on each BEP Agent server, execute as <wf_user>:

$ pkill -f worker.jar
$
$ # check that there are no running worker processes:
$ ps aux | grep 'worker.jar'

To clean the rabbitmq queues up, on the APP server, execute as <wf_user>:

$ wfmanager start rabbitmq
$ rabbitmqctl list_queues --vhost bep | awk '{ print $1 }' | xargs -L1 rabbitmqctl delete_queue --vhost bep
$ wfmanager stop rabbitmq

For the high-availability mode, start rabbitmq on each APP server, then execute the rabbitmqctl command for cleanup, and finally stop rabbitmq.

Under passwords, we assume settings you specify in the config.yml file before product installation.

The config.yml or rpa.yml file are not the sources of settings, from which product components read their configuration. Thus, changing of passwords in config.yml or rpa.yml and saving the file does not update the passwords used by product components on different servers of the environment.

config.yml and rpa.yml are the aggregated config files you usually fill before product installation. They are used only by the installer to read the provided desired settings and save them during deployment to various destinations, where the configuration is stored while the product is running.

The destinations for the settings may vary, and the names of settings in the destinations may differ from settings names in config.yml.

Many same identities appear in multiple places on servers during the deployment and are intended for different purposes. It all depends on how various product components are implemented to read their configuration. For example, if you change s3_access_key in config.yml, it means that the minio-server (s3 emulator) configuration will be updated and the configuration of several other product components which require communication with minio. The same applies to many other settings.

Here is the list of possible destinations where the settings from config.yml are get stored by the installer during deployment:

Hashicorp Vault. The primary "key-value" secret storage embedded into the product. Most of the product services read their configuration from Hashicorp Vault API on initialization of processes.
Various files on the file systems on different servers of the environment. For example, Nexus stores its credentials in encrypted form in the XML file, or minio-server reads s3 keys from environment variables passed to the process in startup script.
Zookeeper nodes. Another "key-value" storage used by many product components.

To update passwords in config.yml:

On the APP server, backup your current config.yml:

$ cd PACKAGE_DIR
$ cp config.yml config_yml_bak

Edit config.yml and change the required passwords:

$ ./install.sh edit_config app

You will be prompted to enter your current <ansible_vault_password>.

Below is the full list of passwords that you might want to update. Update the desired settings and save the file.

ansible_vault_password

s3_access_key
s3_secret_key
wf_username
wf_password
java_cacerts_truststore_pass
marathon_web_pass
mesos_web_pass
rabbitmq_ocr_pass
rabbitmq_bep_pass
rabbitmq_admin_pass
elk_admin_pass
elk_elastic_pass
elk_kibana_pass
wf_sso_saml_metadata_admin_user
wf_sso_saml_metadata_admin_pass
nexus_admin_pass
tableau_dashboard_pass
tableau_admin_pass
ocr_sec_pass
ocr_jwt_secret
workspace_root_requester_pass
bot_manager_jwt_secret
rpa_bot_manager_pass

mail_user
mail_pass

vault_admin_cert_pass
vault_client_cert_pass
elk_logstash_certificate_pass

ocrwin_user
ocrwin_pass

bi_user
bi_pass

rpa_user
rpa_pass

mssql_dba_user
mssql_dba_pass
mssql_ct_user
mssql_ct_pass
mssql_ws_user
mssql_ws_pass
mssql_sqc_user
mssql_sqc_pass
mssql_ds_user
mssql_ds_pass
mssql_rpa_user
mssql_rpa_pass
mssql_pm_user
mssql_pm_pass
mssql_dm_user
mssql_dm_pass
mssql_rapi_user
mssql_rapi_pass
mssql_ocr_user
mssql_ocr_pass
mssql_automl_mms_user
mssql_automl_mms_pass

To update passwords in rpa.yml:

On the APP server, backup your current rpa.yml:

$ cd PACKAGE_DIR
$ cp rpa.yml rpa_yml_bak

Edit rpa.yml and change the required passwords:
```
$ ./install.sh edit_rpa_config app
```
You will be prompted to enter your current <ansible_vault_password>.

Below is the full list of passwords that you might want to update. Update the desired settings and save the file.
```
# for each unit
username
password
```
On the APP server, re-encrypt config.yml and rpa.yml:

Perform this step only if you have updated ansible_vault_password in config.yml.

To re-encrypt config.yml and rpa.yml with new password, run the following command:
```
$ ./install.sh rekey config
```
You will be prompted to enter your old ansible vault password. After command execution, config.yml and rpa.yml become encrypted with a new password that you specified during editing.

Generate new Vault and Logstash certificates

important

Perform this step only if you have updated one of the following settings in config.yml:

vault_admin_cert_pass
vault_client_cert_pass
elk_logstash_certificate_pass

To generate new Vault and Logstash certificates, on the APP server, execute the commands as <linux_installation_user>:

$ rm -rf ./certificates/_auth_internal/vault*
$ rm -rf ./certificates/_auth_internal/logstash*
$ ./install.sh certs generate

After execution, the new vault and logstash certificates are generated, and their private keys are protected by your new passwords:

./certificates/_auth_internal/logstash.crt
./certificates/_auth_internal/logstash.key
./certificates/_auth_internal/logstash.p12
./certificates/_auth_internal/vault_admin.crt
./certificates/_auth_internal/vault_admin.p12
./certificates/_auth_internal/vault_workfusion.crt
./certificates/_auth_internal/vault_workfusion.p12

Update RPA credentials

important

Perform this step only if you changed any of the RPA users' credentials in config.yml.

If you have changed any of the following settings in config.yml, update the RPA Windows users respectively:

rpa_user
rpa_pass

bot_master_user_name
bot_master_user_pass
bot_unit_base_name
bot_unit_pass

The preparation of Windows users is a part of the installation prerequisites, so it is up to you to update them now. You can use both Active directory users or local Windows ones. If you use local Windows users and decide to change only passwords, on the RPA server go to Computer Management > Local Users and Groups > Users > right-click a user > Set Password.

For the multi-point installation, rpa_user and rpa_pass are not used. They are used only by the installer in a single-point installation to connect to the RPA server and execute commands remotely. Basically, in multi-point installation, rpa_user represents the user you use to log in to the RPA machine via RDP.

Only bot_master_user and bot_unit users take part in the product execution.

Update OCRWin credentials

You need to do this step only if all three conditions are met:

Your OCR platform is Windows.
You install the product in the single-point way.
You have updated ocrwin_user or ocrwin_pass in config.yml.

This user is used only in the single-point installation by ansible installer to connect with WinRM to the OCRWin server and execute commands remotely.

Update Analytics credentials

important

You need to do this step only if you're updating BI-related passwords:

bi_user
bi_pass

tableau_dashboard_pass
tableau_admin_pass

Update bi_user on the BI server only for the single-point installation. It is a regular Windows user that is used only by ansible installer to connect to the BI server vie RDP and execute commands remotely. It doesn't take part in the product execution after installation is finished.

If you have earlier changed tableau_dashboard_pass or tableau_admin_pass, to update the BI credentials:

In your browser, log in to Tableau as a current tableau admin.
Go to the Users tab, click on a desired user, then go to the Settings tab > Change Password.

To update the BI credenitals in the HA setup:

Start your standby BI server, and log in to it with a browser (using direct bi_hostname of standby BI server).
Repeat steps 1-2 of the instruction earlier.

Update MS SQL logins credentials

important

You need to do this step only if you are updating any of MS SQL users:

mssql_dba_user
mssql_dba_pass
mssql_ct_user
mssql_ct_pass
mssql_ws_user
mssql_ws_pass
mssql_sqc_user
mssql_sqc_pass
mssql_ds_user
mssql_ds_pass
mssql_rpa_user
mssql_rpa_pass
mssql_pm_user
mssql_pm_pass
mssql_dm_user
mssql_dm_pass
mssql_rapi_user
mssql_rapi_pass
mssql_ocr_user
mssql_ocr_pass
mssql_automl_mms_user
mssql_automl_mms_pass

To update MS SQL passwords:

Connect to your MS SQL server with MS SQL Management Studio as the admin user that must have at least "securityadmin" server role.
Update passwords for MS SQL logins.

If you updated both passwords and usernames, you can create new MS SQL logins and remove old ones on the MS SQL server side.

Distribute updated configuration and certificates

important

Perform this step only for the multi-point installation type.

To copy config.yml and certificates from the APP server to other Linux servers, use any convenient file transferring method.

In this example, we will use file sharing over HTTP from the APP server.

To distribute updated configuration and certificates across servers:

On the APP server, ensure that you are located in PACKAGE_DIR (directory where installer is extracted), and execute:
```
$ cd PACKAGE_DIR
$ python -m SimpleHTTPServer 8443
# Output:
Serving HTTP on 0.0.0.0 port 8443 ...
```
This will make files in PACKAGE_DIR on the APP server downloadable from other servers. Ensure that the port you have chosen is accessible on the APP server (not blocked by firewalls) from other Linux servers.

On all other Linux hosts (BEP Agent, OCR), change the PACKAGE_DIR and APP_HOSTNMAME variables, and run the commands as <linux_installation_user>:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export APP_HOSTNAME=app.example.com

$ cd $PACKAGE_DIR
$ curl -o 'config.yml' http://$APP_HOSTNAME:8443/config.yml
$ curl -o './certificates/_auth_internal/vault_admin.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_admin.crt
$ curl -o './certificates/_auth_internal/vault_admin.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_admin.p12
$ curl -o './certificates/_auth_internal/vault_workfusion.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.crt
$ curl -o './certificates/_auth_internal/vault_workfusion.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.p12
$ curl -o './certificates/_auth_internal/logstash.crt' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.crt
$ curl -o './certificates/_auth_internal/logstash.key' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.key
$ curl -o './certificates/_auth_internal/logstash.p12' http://$APP_HOSTNAME:8443/certificates/_auth_internal/logstash.p12

Copy the vault_workfusion.p12 certificate from the APP server to the RPA and OCRWin servers (if you use Windows-based OCR).

On the RPA server, run Powershell as Administrator, and execute the following commands:

$rpa_install_dir  = 'C:\RPA'  # RPA Installation Directory on this server
$download_from = "app.example.com:8443"  # Hostname of APP server and port on which files are shared

# Downloading vault_workfusion.p12 from APP server and saving it as workfusion.p12 file in ${rpa_install_dir}\bot-agent\ssl\ directory
$wc = New-Object net.webclient
$wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\bot-agent\ssl\workfusion.p12")
$wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\worker\ssl\workfusion.p12")

If your OCR platform is Windows, on the OCRWin server, run Powershell as Administrator, and execute the following commands:

$ocr_install_dir  = 'C:\workfusion'   # OCR Installation Directory on this server
$download_from = "rcm-4200-ha-wfan-10024-ct1.workfusion.com:8443"

# Downloading vault_workfusion.p12 from APP server and saving it as workfusion.p12 file in ${ocr_install_dir}\vault\shared_auth\ directory
$wc = New-Object net.webclient
$wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${ocr_install_dir}\vault\shared_auth\workfusion.p12")

Also, if you have the OCRWin installer on the Windows server, go to the directory where Windows OCR Installer was extracted, edit the ocr_config.ini file, and change the vault_workfusion_cert_pass setting with the same value, as you specified in config.yml for vault_client_cert_pass.

On the APP server, stop file sharing by pressing "Ctrl+C".

Apply configuration

Single-point setup

Multi-point setup

To apply configuration:

On the APP server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh precheck mssql
$ ./install.sh configure mssql
$ ./install.sh configure full

You need to do the following steps only if you're updating password for the Vault client's certificate:

vault_client_cert_pass

Update Vault p12 certificates on RPA servers:
On the APP server, ensure that you are located in PACKAGE_DIR (directory where installer is extracted), and execute:
```
$ cd PACKAGE_DIR
$ python -m SimpleHTTPServer 8443
# Output:
Serving HTTP on 0.0.0.0 port 8443 ...
```
This will make files in PACKAGE_DIR on the APP server downloadable from other servers. Ensure that the port you have chosen is accessible on the APP server (not blocked by firewalls) from other Linux servers.

on RPA server, run Powershell as Administrator, and execute the following commands:

 ```bash
 $rpa_install_dir  = 'C:\RPA'  # RPA Installation Directory on this server
 $download_from = "app.example.com:8443"  # Hostname of APP server and port on which files are shared

 # Downloading vault_workfusion.p12 from APP server and saving it as workfusion.p12 file in ${rpa_install_dir}\bot-agent\ssl\ directory
 $wc = New-Object net.webclient
 $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\bot-agent\ssl\workfusion.p12")
 $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\worker\ssl\workfusion.p12")
 ```

Reboot RPA server

To apply configuration:

On the APP server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh precheck mssql -c local
$ ./install.sh configure mssql -c local
$ ./install.sh configure lb -c local --limit <current_hostnmame>
$ ./install.sh configure int -e skip_common=true -c local --limit <current_hostnmame>
$ ./install.sh configure bep-master -e skip_common=true -c local --limit <current_hostnmame>

On the BEP Agent server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh configure bep-agent -c local --limit <current_hostnmame>

On the APP server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh configure app -e skip_common=true -c local --limit <current_hostnmame>

On the OCR server, run the followng commands:

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh configure ocr -c local --limit <current_hostnmame>

To push OCRWin configs to Zookeeper and Vault, on the APP server, run the commands (only if Windows OCR is used):

$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'

$ cd $PACKAGE_DIR
$ ./install.sh configure ocrwin -c local --limit <current_hostnmame>

Update Tableau data sources connection string

important

You need to do this step only if you're updating MSSQL BI-related passwords:

mssql_dm_user
mssql_dm_pass

Log in to Tableau as administrator.
Go to Datasouces.
Click More '<<•••>> on each datasource.
Edit Connection.
Change Username and Password.
Click <<Test Connection>>.
Save.

Check environment

To check the environment:

Wait for environment to stabilize after startup of services for about 5-7 minutes.

On the APP server, run the command:

$ ./install.sh check app -c local --limit <current_hostnmame> -e test_ml=true -e test_rpa=true -e test_ie=true -e test_desktop=true -e test_ocr=true

WorkFusion Documentation

10.1.6.2

Hardware

Install Linux components

Security settings in Control Tower

Update passwords

important

Prepare installer

important

Prepare environment