10.2. Configure and Run Active-MQ using Encrypted Passwords
Configure Password Encryption
ActiveMQ allows you to encrypt passwords and store them in configuration files. To encrypt the password, perform the following steps:
- Run encrypt command.
$ bin/activemq encrypt --password encrypt123 --input password1 INFO: Using default configuration ... Encrypted text: jkS8uzTLGwAoBzxEadnG6j7vkY1GD4Zt
Wherepasswordis a secret used by the encryptor andinputis the password you want to encrypt.NoteSpecial characters, such as $/^&, are not supported. Use only alphanumeric characters for passwords. - Add the password to the configuration file. By default, the credentials are added to the
$ACTIVEMQ_HOME/conf/credentials-enc.properties.The contents of thecredentials-enc.propertiesuse theENC()function to wrap encrypted passwords. - Instruct the property loader to encrypt variables while loading properties to the memory.NoteThe property loader used for encryption is
$ACTIVEMQ_HOME/examples/conf/activemq-security.xml.The contents of theactivemq-security.xmlshows the configuration that ActiveMQ uses to load encrypted passwords. TheACTIVEMQ_ENCRYPTION_PASSWORDenvironment variable is used to load the encryptor password. The property loads then de-crypts the password from thecredential-enc.propertiesfile.<bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig"> <property name="algorithm" value="PBEWithMD5AndDES" /> <property name="passwordEnvName" value="ACTIVEMQ_ENCRYPTION_PASSWORD" /> </bean> <bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor"> <property name="config" ref="environmentVariablesConfiguration" /> </bean> <bean id="propertyConfigurer" class="org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer"> <constructor-arg ref="configurationEncryptor" /> <property name="location" value="file:${activemq.base}/conf/credentials-enc.properties"/> </bean> - Add the property to the
activemq-security.xmlas shown here:<simpleAuthenticationPlugin> <users> <authenticationUser username="system" password="${activemq.password}" groups="users,admins"/> <authenticationUser username="user" password="${guest.password}" groups="users"/> <authenticationUser username="guest" password="${guest.password}" groups="guests"/> </users> </simpleAuthenticationPlugin>
Run Active-MQ using Encrypted Passwords
To run the Active-MQ broker with encrypted password configuration, follow the following steps:
- Set environment variable for encryption
$ export ACTIVEMQ_ENCRYPTION_PASSWORD=encrypt123
- Set the AMQ broker
$ bin/activemq start xbean:examples/conf/activemq-security.xml
- Reset the environment variable for encryption
$ unset ACTIVEMQ_ENCRYPTION_PASSWORD
Resetting the environment is important to avoid saving passwords on your system.
Configuring the network connector
Given two brokers, Broker A and Broker B, where Broker A is configured to perform authentication, you can configure Broker B to log on to Broker A by setting the
userName attribute and the password attribute in the networkConnector element, as follows:
<beans ...>
<broker ...>
...
<networkConnectors>
<networkConnector name="BrokerABridge"
userName="Username"
password="Password"
uri="static://(ssl://brokerA:61616)"/>
...
</networkConnectors>
...
</broker>
</beans>
If Broker A is configured to connect to Broker B, Broker A's
networkConnector element must also be configured with username/password credentials, even if Broker B is not configured to perform authentication. This is because Broker A's authentication plug-in checks for Broker A's username.
