Encrypting Tomcat passwords in the server.xml file
Before you begin
The solution outlined below provides a level of protection for encrypting passwords in the server.xml file, but does not offer complete security. Crowd still needs to use the plain-text passwords to connect to your database, so your configuration will contain all the information needed to decrypt the password. An attacker could act as Crowd to obtain the password. We recommend that you additionally secure the server where Crowd and its database reside.
Protocols used by Crowd
Crowd provides the following protocols that extend the Tomcat protocols with support for password encryption. You will need to choose one of those protocols in the server.xml file.
Encrypt and use the passwords in the server.xml file
Complete the following steps to encrypt your passwords, and then use them in the server.xml file.
Encrypt your passwords
To encrypt your passwords:
Go to
<Crowd-installation-directory>.Run the following command:
java -cp "./*" com.atlassian.secrets.cli.tomcat.TomcatEncryptionToolWhen prompted, enter the password you want to encrypt.
Result
The encryption tool will generate two files: encryptedPassword_*** and encryptionKey_***. Move those files to a safe location accessible by Crowd. If you’re running a multi-node Crowd configuration, the files must be in a directory accessible by all nodes, for example <Crowd-home-directory>/shared/.
Reusing the encryption key
All encrypted passwords that you’ll provide for a single connector in the server.xml file need to be encrypted using the same encryptionKey. To reuse the encryptionKey created by the encryption tool, you can run the following command:
java -jar crowd-tomcat-encryption-utils-<your crowd version>.jar <path to encryptionKey_***>This command will also prompt you for a password and then encrypt this password using the same encryptionKey
Use your encrypted passwords in the server.xml file
To use the encrypted passwords in your Tomcat configuration, you need to specify the following properties for the connector:
protocol- use one of the protocols listed aboveencryptionKey- specify a path to the encryptionKey file
Then, you can provide the path to the encrypted password files instead of plain-text passwords in the Tomcat configuration.
The following snippet shows an example configuration that uses the Http11NioProtocolWithPasswordEncryption protocol with the encrypted keystore and key passwords:
<Connector
port="8443"
protocol="com.atlassian.secrets.tomcat.protocol.Http11NioProtocolWithPasswordEncryption"
(...)
keystoreFile="/var/secrets/keystore/keystore"
keystorePass="/var/secrets/keystore/encryptedKeystorePass"
keyAlias="tomcat"
keyPass="/var/secrets/keystore/encryptedKeyPass"
productEncryptionKey="/var/secrets/encryptionKey"
/>Note that, as mentioned earlier, you must use the same encryptionKey_*** to encrypt all passwords used for a specific connector, as you can specify only one encryption key. Different connectors can use different keys and protocols.