Edit

Secure secret files

To enhance security measures after installation, it is reasonable to encrypt files like secrets.yml because it contains logins and passwords.

To encrypt and decrypt any sensitive file, go to /tools on DB server.

Encrypt file

To encrypt a file, execute secure-tool.sh.

To encrypt multiple files, use the same password for them. The script is able to encrypt only one file at a time.

Run as wfuser:

./secure-tool.sh

For example:

$ ./secure-tool.sh 
Please enter encrypt or decrypt: encrypt
Please enter path to input file: /opt/workfusion/distr/2018-07-27-1532687852/secrets.yml
Please enter path to output file: /opt/workfusion/distr/2018-07-27-1532687852/secrets.yml.enc
Please enter password: s3c#t_pass
Please enter path to <install_dir>: /opt/workfusion
log4j:WARN No appenders could be found for logger (org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
[INFO ] You are working with safe : workfusion_WFInternal
[INFO ] Properties have been processing.

[INFO ] ansible.vault.pass = s3c#t_pass was added into secure storage
[INFO ] Properties were loaded into the security storage

After the encryption is done, remove unsecured copies of files.

Decrypt file

To decrypt a file, do as follows:

1. View a secure Vault storage to retrieve a password: cd /wf-sec-storagesh loader.sh wfagent review.

2. Execute secure-tool.sh. Run as wfuser:

   ./secure-tool.sh
   

   For example:

   $ ./secure-tool.sh 
   Please enter encrypt or decrypt: decrypt
   Please enter path to input file: /opt/workfusion/distr/2018-07-27-1532687852/secrets.yml.enc
   Please enter path to output file: /opt/workfusion/distr/2018-07-27-1532687852/secrets.yml.dec
   Please enter password: s3c#t_pass
   Please enter path to <install_dir>: /opt/workfusion
   $ cd ..
   $ cd distr/2018-07-27-1532687852/
   $ ls
   secrets.yml  secrets.yml.dec  secrets.yml.enc