DaanHoogland commented on code in PR #669:
URL:
https://github.com/apache/cloudstack-documentation/pull/669#discussion_r3637022427
##########
source/adminguide/events.rst:
##########
@@ -191,29 +201,39 @@ changes can control the behaviour.
</bean>
<bean id="environmentVariablesConfiguration"
class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
- <property name="algorithm" value="PBEWithMD5AndDES" />
+ <property name="algorithm" value="PBEWITHHMACSHA512ANDAES_256"
/>
<property name="passwordEnvName"
value="APP_ENCRYPTION_PASSWORD" />
</bean>
<bean id="configurationEncryptor"
class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
<property name="config" ref="environmentVariablesConfiguration"
/>
+ <property name="ivGenerator">
+ <bean class="org.jasypt.iv.RandomIvGenerator" />
+ </property>
</bean>
- <bean id="propertyConfigurer"
class="org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer">
+ <bean id="propertyConfigurer"
class="com.cloud.utils.crypt.EncryptablePropertyPlaceholderConfigurer">
<constructor-arg ref="configurationEncryptor" />
<property name="location" value="classpath:/cred.properties" />
</bean>
</beans>
- Create a new file in the same folder called ``cred.properties`` and the
specify the values for username and password as jascrypt encrypted strings
+ Create a new file in the same folder called ``cred.properties`` and
specify the values for
+ username and password as jasypt encrypted strings, wrapped as
``ENC(...)``.
Sample, with ``guest`` as values for both fields:
.. code:: bash
- username=nh2XrM7jWHMG4VQK18iiBQ==
- password=nh2XrM7jWHMG4VQK18iiBQ==
+ username=ENC(nh2XrM7jWHMG4VQK18iiBQ==)
+ password=ENC(nh2XrM7jWHMG4VQK18iiBQ==)
+
+ ``PBEWithMD5AndDES``, used in earlier releases of this guide, is a weak
algorithm and should
+ not be used for new deployments; ``PBEWITHHMACSHA512ANDAES_256`` above
is a stronger,
+ future-proof alternative. Use the ``jasypt`` CLI tools (or any tool
using the jasypt library)
+ with the same algorithm, IV generator and ``APP_ENCRYPTION_PASSWORD`` to
produce the
+ encrypted values for ``cred.properties``.
Review Comment:
```suggestion
``PBEWithMD5AndDES``, used in earlier releases of this guide, is a
weak algorithm and should
At least ``PBEWITHHMACSHA512ANDAES_256`` or stronger algorithms should
be used. Use the ``jasypt`` CLI tools (or any tool using the jasypt library)
with the same algorithm, IV generator and ``APP_ENCRYPTION_PASSWORD``
to produce the
encrypted values for ``cred.properties``.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
