Table of Contents
Table of Contents | ||||
---|---|---|---|---|
|
Introduction
By default passwords (e.g. the default password for Redis or MySQL) are configured in plain text in the configuration files. However we provide a mechanism so that this sensitive information can be encrypted. The encryption happens on installation of Squirro. There are three different ways to encrypt values in configuration files:
Encryption methods
There are three modes of encrypting Squirro configuration files:
- Encryption key in a Unix environment variable
- Encryption key stored in a file
- Custom command for encrypting and decrypting
Environment variable
If you set the value of the environment variable SQ_ENCRYPTION_KEY
to a valid encryption key, all encrypted configuration values will be decrypted on load. If this environment variable is set prior to installation of Squirro already, then all sensitive configuration values will be encrypted with this key and stored in an encrypted fashion in the INI files. You recognise such a value as it starts with CK_FERNET::
. On usage of the value it will be decrypted automatically.
Generating key
Run the following commands in Python to generate a valid encryption key:
Code Block | ||
---|---|---|
| ||
from cryptography.fernet import Fernet
key = Fernet.generate_key()
print(key.decode()) |
Key stored in a file
This is very similar to the previous approach but the encryption key is stored in a file instead of an environment variable. For this to work you set SQ_ENCRYPTION_KEY_FILE
environment variable to the (absolute) path of a file containing nothing but the encryption key.
For how to generate a valid encryption key, see the previous section.
Custom encryption
If you want to provide your own encryption and decryption algorithms instead, you can set the two environment variables SQ_ENCRYPT_COMMAND
and SQ_DECRYPT_COMMAND
. They are called with the configuration section and the configuration key as program arguments and the value to en/decrypt is sent on stdin. The en/decrypted value is returned on stdout with an exit status 0.
An example invocation of this script:
Code Block | ||
---|---|---|
| ||
$ echo "my password" | /usr/bin/my_decrypt mysql password |
An example encryption and decryption script:
Code Block | ||
---|---|---|
| ||
#!/bin/bash
cat /dev/stdin | rev |
This just reverts the order of the password - which is obviously not safe for production at all.
The prefix for encrypted values in this case is: CK_CMD
.
Precedence
If multiple of these environment variables are configured, the following shows the precedence:
SQ_ENCRYPTION_KEY
SQ_ENCRYPTION_KEY_FILE
SQ_ENCRYPT_COMMAND
andSQ_DECRYPT_COMMAND
Encrypt
To encrypt values, set the right environment variables before installing Squirro.
If you want to turn on encryption after the initial Squirro installation, run the following command:
Code Block | ||
---|---|---|
| ||
python /opt/squirro/tools/secure-001-encrypt-config-files.py |
The Squirro environment /wiki/spaces/KB/pages/25591902.
Validate Encryption
Only encoded passwords found in configuration files.
Code Block | ||||
---|---|---|---|---|
| ||||
$ cd /etc/squirro
# should return nothing
$ grep -rn . -e $PLAIN_PASSWORD
# should return all encoded passwords
$ grep -rn . -e 'CK_FERNET'
./cluster.ini:14:password = CK_FERNET::gAAAAABhQz8...
./datasource.ini:15:redis_password = CK_FERNET::gAAAAABhQz8wb2pcLWhZmao6zt9UeR... |
Starting Squirro
To start Squirro after you have encrypted the configuration files, ensure that this environment variable are available for the daemons. You do this by adding them in to the following file: /etc/sysconfig/squirro
.
The file contains commented out versions of these keys by default. Comment out the appropriate key and set the desired value.
...
This page can now be found at Securing Configuration Files on the Squirro Docs site.