Encrypting Your Database Password

|variable_prod_name| requires you to encrypt your database password before including it in the cluster properties file. Use the efm utility (located in the /usr/edb/efm-3.10/bin directory) to encrypt the password. When encrypting a password, you can either pass the password on the command line when you invoke the utility, or use the EFMPASS environment variable.

To encrypt a password, use the command:

# efm encrypt <cluster_name> [ --from-env ]

Where <cluster_name> specifies the name of the |variable_prod_name| cluster.

If you include the --from-env option, you must export the value you wish to encrypt before invoking the encryption utility. For example:

export EFMPASS=password

If you do not include the --from-env option, |variable_prod_name| will prompt you to enter the database password twice before generating an encrypted password for you to place in your cluster property file. When the utility shares the encrypted password, copy and paste the encrypted password into the cluster property files.

Please note: : Many Java vendors ship their version of Java with full-strength encryption included, but not enabled due to export restrictions. If you encounter an error that refers to an illegal key size when attempting to encrypt the database password, you should download and enable a Java Cryptography Extension (JCE) that provides an unlimited policy for your platform.

The following example demonstrates using the encrypt utility to encrypt a password for the acctg cluster:

# efm encrypt acctg
This utility will generate an encrypted password for you to place in
 your EFM cluster property file:
/etc/edb/efm-|variable_prod_version|/acctg.properties
Please enter the password and hit enter:
Please enter the password again to confirm:
The encrypted password is: 516b36fb8031da17cfbc010f7d09359c
Please paste this into your acctg.properties file
db.password.encrypted=516b36fb8031da17cfbc010f7d09359c

Please note: : The utility will notify you if a properties file does not exist.

After receiving your encrypted password, paste the password into the properties file and start the |variable_prod_name| service. If there is a problem with the encrypted password, the |variable_prod_name| service will not start:

[witness@localhost ~]# service edb-efm-|variable_prod_version| start
Starting local edb-efm-|variable_prod_version| service: [FAILED]

If you receive this message when starting the |variable_prod_name| service, please see the startup log (located in /var/log/efm-3.10/startup-efm.log) for more information.

If you are using RHEL/CeonOS 7.x or RHEL/CentOS 8.x, startup information is also available with the following command:

systemctl status edb-efm-|variable_prod_version|

To prevent a cluster from inadvertently connecting to the database of another cluster, the cluster name is incorporated into the encrypted password. If you modify the cluster name, you will need to re-encrypt the database password and update the cluster properties file.

Using the EFMPASS Environment Variable

The following example demonstrates using the –from-env environment variable when encrypting a password. Before invoking the efm encrypt command, set the value of EFMPASS to the password (1safepassword):

# export EFMPASS=1safepassword

Then, invoke efm encrypt, specifying the --from-env option:

# efm encrypt acctg --from-env
# 7ceecd8965fa7a5c330eaa9e43696f83

The encrypted password (7ceecd8965fa7a5c330eaa9e43696f83) is returned as a text value; when using a script, you can check the exit code of the command to confirm that the command succeeded. A successful execution returns 0.