红帽全球峰会此内容没有您所选择的语言版本。
Chapter 8. Using a Password Vault with Red Hat JBoss Web Server 3
A password vault is used to mask passwords and other sensitive strings, and store them in an encrypted Java keystore. This allows you to eliminate storing clear-text passwords in your Tomcat configuration files, as Tomcat can lookup passwords and other sensitive strings from a keystore using the vault.
The examples and commands below use JWS_HOME as the JBoss Web Server installation directory. Replace JWS_HOME with the path to your JBoss Web Server installation. Also, the paths below use / for directory separators.
8.1.1. Installing the JBoss Web Server password vault
There are two methods of installing the JBoss Web Server password vault:
-
Installing the JBoss Web Server password vault on Red Hat Enterprise Linux from an RPM (For Red Hat Enterprise Linux systems where JBoss Web Server was installed using
yumonly). - Downloading and Extracting the Vault Files from a .zip archive (Available for all JBoss Web Server installations).
Where the JBoss Web Server has been installed from RPMs on Red Hat Enterprise Linux, install the password vault as the root user by executing:
yum install tomcat-vault tomcat-vault-tomcat<VERSION>
yum install tomcat-vault tomcat-vault-tomcat<VERSION>
Where <VERSION> is either 7 for tomcat 7 (tomcat-vault-tomcat7) or 8 for tomcat 8 (tomcat-vault-tomcat8).
In the tomcat-vault RPM installation, the vault jar is located in /usr/share/java/vault-tomcat-<VERSION>-jar-with-dependencies.jar. This jar can be used in JWS zip installation: JWS_HOME/tomcat_<VERSION>_/lib/ For JWS RPM installation: /usr/share/tomcat<VERSION>/lib.
- Stop Tomcat if it is running.
-
Extract the contents of the vault zip to your
JWS_HOMEdirectory. In this topic,JWS_HOME/tomcat-vaultwill refer to the extracted vault directory. -
Copy
JWS_HOME/tomcat-vault/modules/system/layers/base/tomcat-vault/main/tomcat-vault.jartoJWS_HOME/tomcat<VERSION>/lib/. EditJWS_HOME/tomcat<VERSION>/conf/catalina.properties, and add the following line:
org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.vault.util.PropertySourceVault
org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.vault.util.PropertySourceVault8.1.2. Creating a Java Keystore
To use a password vault, you must first create a Java keystore. You can do this using the keytool -genseckey command. For example:
keytool -genseckey -keystore JWS_HOME/tomcat/vault.keystore -alias my_vault -storetype jceks -keyalg AES -keysize 128 -storepass <vault_password> -keypass <vault_password> -validity 730
$ keytool -genseckey -keystore JWS_HOME/tomcat/vault.keystore -alias my_vault -storetype jceks -keyalg AES -keysize 128 -storepass <vault_password> -keypass <vault_password> -validity 730The values above are examples only. Replace them with values specific to your environment.
For an explanation of the parameters, use the keytool -genseckey -help command.
This feature was introduced by JBoss Web Server 3.1 Service Pack 2.
The vault.properties file for the tomcat-vault can be stored outside of JWS_HOME/tomcat<VERSION>/conf/ in a CATALINA_BASE/conf/ directory (if set).
To set the CATALINA_BASE directory, follow the instructions in the section 'Advanced Configuration - Multiple Tomcat Instances' in the Running The Apache Tomcat 8.0 Servlet/JSP Container document found on the Apache Tomcat Website.
The default location for CATALINA_BASE is JWS_HOME/tomcat<VERSION>/ (also known as CATALINA_HOME).
For more information on setting CATALINA_BASE, see:
8.1.4. Initializing the Password Vault
The vault must be initialized before it can be used to store sensitive strings. This is done using the JWS_HOME/tomcat-vault/bin/tomcat-vault.sh vault script. For Microsoft Windows, the script is tomcat-vault.bat.
The script can be run interactively or non-interactively. Below is an example of an interactive execution of the script to initialize a password vault, with the values shown below using the example keystore from the previous step.
The values below are examples only. Replace them with values appropriate for your environment.
Note the output for the Tomcat properties file, as you will need this to configure Tomcat to use the vault.
Configuring Tomcat to Use the Password Vault
In JWS_HOME/tomcat<VERSION>/conf/, create a file named vault.properties containing the vault configuration produced when initializing the vault. The values provided below use the example vault initialized in the previous steps.
For KEYSTORE_PASSWORD, you must use the masked value that was generated when initializing the vault.
The Vault for Apache Tomcat can be created non-interactively by providing the required input as arguments to the tomcat-vault.sh script. The vault.properties file is also created as output of the tomcat-vault.sh script when the -g, --generate-config option is used.
The values below are examples only. Replace them with values appropriate for your environment.
8.1.5. Storing a Sensitive String in the Password Vault
The vault script used in the previous steps is also used to store sensitive strings in the password vault. The script can be run interactively or non-interactively.
When adding a string to a password vault, the sensitive string needs a name that it will be referred by. For a password vault, this name is called an attribute name, and the password itself is called a secured attribute.
The example below demonstrates using the vault script non-interactively to store a password. It uses the vault that was initialized in the previous steps, and stores the sensitive string P@SSW0#D with the attribute name manager_password.
JWS_HOME/tomcat-vault/bin/tomcat-vault.sh --keystore JWS_HOME/tomcat-vault/vault.keystore --keystore-password <vault_password> --alias my_vault --enc-dir JWS_HOME/tomcat-vault/ --iteration 120 --salt 1234abcd --vault-block my_block --attribute manager_password --sec-attr P@SSW0#D
$ JWS_HOME/tomcat-vault/bin/tomcat-vault.sh --keystore JWS_HOME/tomcat-vault/vault.keystore --keystore-password <vault_password> --alias my_vault --enc-dir JWS_HOME/tomcat-vault/ --iteration 120 --salt 1234abcd --vault-block my_block --attribute manager_password --sec-attr P@SSW0#DYou can optionally specify a vault block to store the password in. If you don’t specify a block, one will be automatically created for you. In the above example, my_block is used.
After storing a sensitive string in the password vault, you can refer to it in your configuration files by entering the stored string’s attribute as ${VAULT::block_name::attribute_name::}.
For example, to use the password stored in the previous steps, replace:
<user username="manager" password="P@SSW0#D" roles="manager-gui"/>
<user username="manager" password="P@SSW0#D" roles="manager-gui"/>with:
<user username="manager" password="${VAULT::my_block::manager_password::}" roles="manager-gui"/>
<user username="manager" password="${VAULT::my_block::manager_password::}" roles="manager-gui"/>As a result, only a reference to the password is visible in the Tomcat configuration file, and the actual password is only stored in the password vault.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}