Administering encrypted passwords

Fleet and individual sensor passwords should be encrypted before they are stored in inventory. Using the encrypted_pass field allows you to replace the use of plain text passwords in your Corelight-update configuration file.

To use encrypted passwords:

  1. Use the Corelight-update CLI command with the in encrypt switch to encrypt the password string. When using special characters in your password string, wrap it in quotes. See CLI commands for more details.

  2. Copy the encrypted password output from the console, and use it to update the encrypted_pass: field of the sensor inventory record, or Fleet configuration in the policy configuration file.

  3. Verify the password: field of the sensor inventory record, or Fleet configuration is empty.

  4. Save the changes, and update the Corelight-update policy.

Note

A Fleet Manager configuration or sensor inventory record should not have both the password and encrypted_pass fields populated. Make sure to leave the password field blank when using the encrypted_pass field. If both fields are populated, the password field will be used.

Using the Corelight-update CLI command with the in encrypt switch encrypts the password string using AES256 encryption. The encryption master key is randomly generated, and stored in the file /var/corelight-update/.corelight-update.

If the master key is removed and regenerated, all encrypted passwords will also have to be regenerated. A password must be encrypted with the current key to be decrypted successfully.

To generate a new master key, delete the existing key, and a new one will automatically be created when needed.