Security (2.2)
- Jenni Wallin
- Former user (Deleted)
- Export User
- Kevin Wu
The Security profile is a generic profile that you can use to make encryption configurations that can be used by various agents. For example, the HTTP/2 and Kafka agents.
The profile consists of three tabs: General, Advanced and Vault.
General Tab
Keystore Settings
The following settings are available:
| Settings | Description |
|---|---|
| Type | You can select from the following options:
Selecting Vault Keystore or <None> disables the rest of the keystore settings. Selecting Vault Keystore will require the Vault access credentials to be populated under the Vault tab. |
Path | Enter the location of the keystore from which you want to read the key. |
| Password | Enter the relevant keystore password. |
| Public Key Alias | The encryption alias to use. In a client it should be the alias to the server public certificate. If left empty the Keystore Alias will be used to encrypt the message. |
| Private Key Alias | If the keystore contains more than one key, specify the alias of the key that you want to use. |
| Key Password | The Key Password fields is optional. You can enter the key password, or if you leave this field empty, the Password that you entered is the default. |
Example - How to create a symmetric crypto key
$ keytool -keystore test.ks -storepass password -genseckey -keysize 128 -alias testkey -keyalg AES
Example - How to create a Keystore file with security contents
This example code shows how to create a Java keystore file for both the server and client connection. In this example this will generate the file, containing the associated security certificate, public and private key.
keytool -genkey -alias server -keyalg RSA -keystore ./server.jks
NOTE: Remember the password issued for the server.jks file.
Example - How to create a client-specific Keystore file
To create a client-specific Java Keystore file, you can use the keytool command with the required variables. In this example the generated file will be for a specific client and contain only their certificate and public key.
$ keytool -export -alias server -keystore ./server.jks -file ./server.cer ... $ keytool -import -alias client -file ./server.cer -keystore ./client.jks ...
Note: Execution of these commands will present password entry prompts, you will need to remember the entered passphrase.
Truststore Settings
The following settings are available:
| Settings | Description |
|---|---|
| Type | You can select from the following options:
Selecting Use Java Keystore disables the rest of the truststore settings and the keystore specified in Keystore Settings is used. Selecting Vault Truststore or Use Vault Keystore disables the rest of the truststore settings and will require the Vault access credentials to be populated under the Vault tab. Selecting <None> disables the rest of the truststore settings. |
Path | Enter the location of the truststore that you want to use. |
| Password | Enter the relevant truststore password. |
Advanced Tab
The Advanced tab enables you to make more detailed configurations for which cipher suites to accept.
The following settings are available:
| Settings | Description |
|---|---|
| Enable TLS Settings | If you want to change the TLS security parameters, select this check box. The default setting is to use the settings from the Java installation. |
| Accepted Protocols | You can select if you want agents using this profile to accept only TLS version 1.3 or any TLS version. The default setting is to only accept version 1.3. |
| Used Cipher Suites | You can select if you want agents using this profile to use only suites that are enabled by default, or any suites. The default setting is to only use suites that are enabled by default. |
| Cipher Suite Must Match | In this field you can enter any characters that you want the cipher suites to match. You can also enter lists of regular expression, one per row, that you want the cipher suites to match. Suites not matching your entry are greyed out in the Result on this JVM field. |
| Cipher Suite Must Not Match | If you want to exclude cipher suites, you can enter any characters in this field which excludes suites matching the characters. You can also enter lists of regular expression, one per row, for cipher suites to exclude. |
| Result on this JVM | This field displays the cipher suites available on the current JVM. |
Vault Tab
The Vault tab enables you to utilize a vault that has been set up to include all the keystore and the truststore that will be used by your configuration, allowing you to store all your SSL certificates in one secure location. We will not cover the installation and set up of a vault, but you may refer to https://learn.hashicorp.com/vault for more information regarding vault.
Note!
Using the Security profile with vault configured with Kafka agents is not supported.
Info!
When setting up your vault, it is recommended that you have the following set up:
- Set up a Key-Value (kv) Secret
- Enable Userpass authentication instead of the default token authentication.
- Set up a policy with read and list permissions and assign it to a user.
| Settings | Description |
|---|---|
| Auth Methods | The authentication method for accessing the vault. |
| Address | The address for the vault. The format of the address will start with the hyper text transfer protocol, either HTTP or HTTPS, followed by the IP address of the vault and the TCP port used by the TCP listener of the vault. Example https://127.0.0.1:8200 |
| Username | Enter the username that is used to access the vault. |
| Password | Enter the password that is used to access the vault. |
| Path | The full path of the vault secret engine that contains the relevant keystore or truststore. Example secret/digitalroute/mz/security/server |
Uploading a keystore into your vault
Usage Engine will require certain criteria to be met when uploading the keystore into your vault. The following command will help show you how to upload.
vault kv put secret/digitalroute/mz/security/<PATH_PREFIX>/keystore filecontent="$(cat <PATH_TO_KEYSTORE>.jks | base64)" password=<PASSWORD> keyalias=<KEYALIAS> keypassword=<KEYPASSWORD>
The options for the command follow a certain format that has to be adhered to. The workflow will abort if it calls the security profile with the vault credentials that are saved in a different format as listed in the table below.
| Options | Value Format |
|---|---|
filecontent | Base64 String |
keyalias | String |
keypassword | String |
password | String |
Uploading a truststore into your vault
Usage Engine will require certain criteria to be met when uploading the truststore into your vault. The following command will help show you how to upload.
vault kv put secret/digitalroute/mz/security/<PATH_PREFIX>/truststore filecontent="$(cat <PATH_TO_TRUSTSTORE>.jks | base64)" password=<PASSWORD>
The options for the command follow a certain format that has to be adhered to. The workflow will abort if it calls the security profile with the vault credentials that are saved in a different format as listed in the table below.
| Options | Value Format |
|---|---|
filecontent | Base64 String |
password | String |