How to encrypt configuration file?

In today's security-conscious world, protecting sensitive data is a top priority for organizations. Recognizing this need, yCrash offers an encryption solution that allows enterprise customers to securely manage their configuration files. This feature is designed to protect sensitive data such as configuration files and system properties, which often contain critical details like passwords.

This guide walks you through the process of encrypting and decrypting sensitive information using yc-codec.jar, included with yCrash. It can be found in the <ycrash_build>/tools/codec directory.

Storing the Master Password in a Keystore

To securely store an encryption key, use Java's keytool to create a keystore and add an AES secret key entry:

<JDK_HOME>/bin/keytool -genseckey -keystore mykeystore.p12 -storepass keystorePassword -alias aesPasswordAlias -keyalg AES -keysize 128 -storetype PKCS12

Explanation of Command Options:

• -genseckey: Generates a new secret key entry.

• -keystore mykeystore.p12: Specifies the path to your keystore file. If the file doesn’t exist, keytool will create it; if it exists, the new secret key will be added to it.

• -storepass keystorePassword: Sets a password for the keystore, required whenever accessing its contents.

• -alias aesPasswordAlias: Unique identifier for the AES key within the keystore.

• -keyalg AES: Specifies AES as the algorithm for the key.

• -keysize 128: Sets the key size. For AES, use 128, 192, or 256 bits.

• -storetype PKCS12: This is a standard keystore format that is widely supported across different platforms and tools.

How to run yc-codec.jar?

To run yc-codec.jar, use the following syntax:

java -jar yc-codec.jar <type> <keystore_file_path> <keystore_password> <keystore_alias> <configuration_directory_path_or_single_string>

Arguments:

1. Type: Use -encode to encrypt and -decode to decrypt.

2. Keystore file path: Path to your Java KeyStore (.p12 file) where the secret key is stored.

3. Keystore password: The password for your KeyStore. This password is used to protect the keystore file from unauthorized access. The password is required when accessing or modifying the keystore contents.

4. Keystore alias: An alias is a unique name given to the secret key entry in the keystore.

5. Configuration directory path or single string:

   5.1. If you want to encrypt/decrypt configuration files, pass the directory path containing configuration files.
   5.2. If you only want to encrypt/decrypt a single string, pass the string directly.

Examples:

1. Encrypt all files saved in directory:

java -jar yc-codec.jar -encode /usr/ycrash/yc-codec.p12 ycCodecPass ycCodecAlias /opt/ycrash/config/

2. Encrypt single string:

java -jar yc-codec.jar -encode /usr/ycrash/yc-codec.p12 ycCodecPass ycCodecAlias ycAdminPassword

3. Decrypt all files saved in directory:

java -jar yc-codec.jar -decode /usr/ycrash/yc-codec.p12 ycCodecPass ycCodecAlias /opt/ycrash/config/encrypt

4. Decrypt single string:

java -jar yc-codec.jar -decode /usr/ycrash/yc-codec.p12 ycCodecPass ycCodecAlias V3Zddeuon39JIlfewpos+fhes=

Important Notes:

1. The arguments must be provided in the exact order shown above.
2. If you pass a directory path, the JAR will encrypt all files within the given directory.
3. Encrypted files will be stored in a new subdirectory named encrypted inside the specified configuration directory. The paths of the encrypted files will be displayed on the console.
4. If you're encrypting a single string (such as an admin password), the encrypted value will be printed directly to the console for easy use in your configuration (e.g., in a yCrash launch script).

Configure yCrash Server for Decryption

To decrypt configuration files or individual string, the yCrash application will need access to the KeyStore. Ensure that the following arguments are configured in your yCrash launch scripts:

• Keystore file path (.p12 file path)
• Keystore password
• Keystore alias

Example:

-Dyc.codec.keyStore=keystore_file_path 
-Dyc.codec.keyStorePassword=keystore_password 
-Dyc.codec.keyStoreAlias=keystore_alias

This will allow the yCrash server to retrieve the master password from the KeyStore and decrypt your configuration files automatically.

Alternative Options for Keystore Password:

If you prefer not to pass the keystore password -Dyc.codec.keyStorePassword as a system property, use one of the following methods:

1. Environment variable

• Set key store password in environment variable

  • Unix/Linux/MacOS:

  export YC_CODEC_KEYSTORE="your_password"
  

  • Windows:

  Learn how to set environment variable (opens new window)

2. Create a Hidden File to Store the Password

Create a hidden file on your machine to save key store password and pass the file path to the -DycCodecFile system property in your launch script file.

• Create hidden file

  Unix/Linux/MacOS: In Unix-based operating systems (Linux, macOS), files are hidden by prefixing their names with a dot (.).

  Using Command Line:

  1. Open your terminal.

  2. Use the touch command to create a new hidden file by prefixing the filename with a dot.

  touch .hiddenfilename
  

  3. Replace .hiddenfilename with your desired filename, starting with a dot to make it hidden.

  Windows: In Windows, hidden files are created by setting a hidden attribute on the file.

  Using Command Line:

  1. Open Command Prompt.

  2. Navigate to the directory where you have your file.

  3. Set the hidden attribute using the attrib command.

  attrib +h filename.txt
  

  4. Replace filename.txt with your desired filename. This file will be hidden in the File Explorer.

• Update launch script

  • Modify your launch script to reference the hidden file for the keystore password. If your original launch-yc-server.sh script looks like this:

  java -Xms2g -Xmx4g -DlogDir=. -DuploadDir=. -jar webapp-runner.jar -AconnectionTimeout=3600000 --port 8080 yc.war &
  

  • Update it to include the ycCodecFile property:

  java -Xms2g -Xmx4g -DycCodecFile=/opt/ycrash/.yc-codec -DlogDir=. -DuploadDir=. -jar webapp-runner.jar -AconnectionTimeout=3600000 --port 8080 yc.war &
  

  Here:

  -DycCodecFile=/opt/ycrash/.yc-codec: Specifies the path to your hidden password file.
  

After configuring the password storage method, restart your yCrash application to ensure the decryption settings are applied.