16.4. Create password masks
jboss-as/bin/password/jboss_password_enc.dat. This file is encrypted using a key pair you provide to the password tool, and it contains the passwords that will be masked in configuration files. Passwords are stored and retrieved from this file by 'domain', an arbitrary unique identifier that you specify to the Password Tool when storing the password, and that you specify as part of the annotation that replaces that clear text password in configuration files. This allows the JBoss Application Server to retrieve the correct password from the file at run time.
Note
jboss-as/bin/password/password.keystore) and encrypted key store password file (jboss-as/bin/password/jboss_keystore_pass.dat) readable by your user, and the encrypted passwords file jboss-as/bin/password/jboss_password_enc.dat (if it already exists) read and writable, while you perform this operation.
Procedure 16.4. Create password masks
Prerequisites:
- At the command line, change to the
jboss-as/bindirectory. - Run the password tool, using the command
./password_tool.shfor Unix-based systems, orpassword_tool.batfor Windows-based systems.Result:The JBoss Password Tool will start, and will report '
Keystore is null. Please specify keystore below:'. - Select '
1:Specify KeyStore' by pressing 1 then Enter.Result:The password tool responds with '
Enter Keystore location including the file name'. - Enter the path to the key store you created in Procedure 16.2, “Generate a key pair and key store for password masking”. You can specify an absolute path, or the path relative to
jboss-as/bin. This should bepassword/password.keystore, unless you have performed an advanced installation and changed the defaults as per Section 16.6, “Changing the password masking defaults”.Result:The password tool responds with '
Enter Keystore alias'. - Enter the key alias. This should be
jboss, unless you have performed an advanced installation and changed the defaults as per Section 16.6, “Changing the password masking defaults”.Result:If the key store and key alias are accessible, the password tool will respond with some log4j WARNING messages, then the line '
Loading domains [', followed by any existing password masks, and the main menu. - Select '
2:Create Password' by pressing 2, then EnterResult:The password tool responds with: '
Enter security domain:'. - Enter a name for the password mask. This is an arbitrary unique name that you will use to identify the password mask in configuration files.Result:
The password tool responds with: '
Enter passwd:'. - Enter the password that you wish to mask.Result:
The password tool responds with: '
Password created for domain:mask name' - Repeat the password mask creation process to create masks for all passwords you wish to mask.
- Exit the program by choosing '
5:Exit'
