Administering encrypted passwords¶
Fleet and individual sensor passwords should be encrypted before they are stored in inventory. Using the encrypted_pass
field allows you to replace the use of plain text passwords in your Corelight-update configuration file.
To use encrypted passwords:
Use the Corelight-update CLI command with the in
encrypt
switch to encrypt the password string. When using special characters in your password string, wrap it in quotes. See CLI commands for more details.Copy the encrypted password output from the console, and use it to update the
encrypted_pass:
field of the sensor inventory record, or Fleet configuration in the policy configuration file.Verify the
password:
field of the sensor inventory record, or Fleet configuration is empty.Save the changes, and update the Corelight-update policy.
Note
A Fleet Manager configuration or sensor inventory record should not have both the password
and encrypted_pass
fields populated. Make sure to leave the password
field blank when using the encrypted_pass
field. If both fields are populated, the password
field will be used.
Using the Corelight-update CLI command with the in encrypt
switch encrypts the password string using AES256 encryption. The encryption master key is randomly generated, and stored in the file /var/corelight-update/.corelight-update
.
If the master key is removed and regenerated, all encrypted passwords will also have to be regenerated. A password must be encrypted with the current key to be decrypted successfully.
To generate a new master key, delete the existing key, and a new one will automatically be created when needed.