IBM Tivoli Netcool/OMNIbus V7.2.1 IBM Tivoli Netcool/OMNIbus V7.2.1 Advanced Encryption Standard (AES) property value encryption Hello, and welcome to the OMNIbus IBM Education assistance module, AES property value encryption. Introduction Introduction You might use property value encryption to encrypt string values in a properties file or configuration file so that the strings cannot be read without a key. When the process that uses the properties file or configuration file starts, the strings are decrypted. You might use this encryption mechanism in ObjectServer, proxy server, probe, and gateway properties files. You might also use this mechanism to encrypt passwords that are stored in process agent configuration files. You might use property value encryption to encrypt string values in property or configuration files so that the strings cannot be read without a key. When a process uses the property or configuration file starts, the strings are decrypted. You might use this encryption in ObjectServer, proxy server, probe, and gateway properties files. You might also use this encryption for passwords that are stored in process agent configuration files. Introduction Introduction The property value encryption mechanism uses the Advanced Encryption Standard (AES), which supports keys of 128, 192, and 256 bits, a command-line key generator (nco_keygen), and an encryption utility (nco_aes_crypt). Cryptographic algorithms are also available in Federal Information Processing Standard (FIPS) 140–2 and non-FIPS 140–2 mode. OMNIbus 7.2.1 might use the AES standard. The AES standard, in OMNIbus, provides greater key support, the nco_keygen key generator, and the nco_aes_crypt utility. Cryptographic algorithms are also available in Federal Information Processing Standard (FIPS) and non-FIPS mode. General guideline General guideline Run the nco_keygen utility to generate a key and store it in a key file. Set the value of the ConfigKeyFile property to the file path and file name of the key file that the nco_keygen utility generated. Use the nco_aes_crypt utility to encrypt a string value with the key that the nco_keygen utility generated. After encrypting a string value, add it to the properties file where you want to hide the actual value. The general guideline to use the new AES encryption standard are to: Run the nco_keygen utility to generate a key and store it in a key file. Set the value of the ConfigKeyFile property to the file path and file name of the key file that the nco_keygen utility generated. Use the nco_aes_crypt utility to encrypt a string value with the key that the nco_keygen utility generated. After encrypting a string value, add it to the properties file within which you want to hide the actual value. Use the nco_keygen utility Use the nco_keygen utility The key you create is used to decrypt values called on system access to a property or configuration file. You have the following choices when creating a key: Create a single key that is used by all properties files or configuration files Create a key for each properties file or configuration file. You might create a single key that is used by all the properties or configuration files, or create a key for each properties or configuration file. Use the nco_keygen utility Use the nco_keygen utility Run nco_keygen as follows: shell$> $OMNIHOME/bin/nco_keygen -o $NCHOME/etc/security/keys/netcool.keygen Additionally, you might specify the – l option to use a greater encryption key length. Only 128 (default), 192, and 256 are valid key lengths for AES encryption. key_file [-l length | -k key] The nco_keygen command might be run with the default values or additional parameters. Additional parameters include: key_file which represents the output file path and file name to which the key is saved. length 3which represents the length in bits of the key, as specified by you. This number must be divisible by 8 to make a whole number of bytes. The default is 128. Only 128, 192, and 256 are valid key lengths for AES encryption. And key which represents the value of your specified key in hexadecimal digits. Specifying the key file as a property Specifying the key file as a property Choose the properties file in which you want to specify an encrypted string value. Set the value of the ConfigKeyFile property to the file path and file name of the key file that the nco_keygen utility generated. You might set the ConfigKeyFile property in these files: ObjectServer properties files Proxy server properties files Probe properties files Gateway properties files Choose the properties file in which you want to specify an encrypted string value. Set the value of the ConfigKeyFile property to the file path and file name of the key file that the nco_keygen utility generated. You might set the ConfigKeyFile property in these files: ObjectServer properties files Proxy server properties files Probe properties files Gateway properties files. Specifying the key file as a property Specifying the key file as a property An example of the property entry in a file is as follows: ConfigKeyFile: ‘$NCHOME/etc/security/keys/netcool.keygen’ At run time, the ConfigKeyFile property is used to decrypt encrypted string values in the file. When running the process agent daemon nco_pad, you must use the -keyfile command-line option to specify the file path and file name of the key file. At run time, the ConfigKeyFile property is used to decrypt encrypted string values in the file. When running the process agent daemon nco_pad, you must use the –keyfile command-line option to specify the file path and file name of the key file. Other property values in files Other property values in files You might also use other property values within files. These examples show some of these values. To run in FIPS 140-2 compliance, use the ConfigCryptoAlg property in your files, as in following example. ConfigCryptoAlg: ‘AES_FIPS’ in files -cryptalgorithm ‘AES_FIPS’ in the nco_pad command line You might set the PasswordEncryption property within your ObjectServer property file in one of the following two ways: At ObjectServer creation: shell$> nco_dbinit -pwdenc AES -server NCOMSA Within the existing ObjectServer’s property file: PasswordEncryption: 'AES' You might also use other property values within files. These examples show some of these values. To run in FIPS 140-2 compliance, use the ConfigCryptoAlg property in your files, as in following example. ConfigCryptoAlg: AES_FIPS in files And -cryptalgorithm ‘AES_FIPS’ in the nco_pad command line You might set the PasswordEncryption property within your ObjectServer’s property file in one of the following two ways: At ObjectServer creation by using the nco_dbinit -pwdenc AES -server NCOMSA or within the existing ObjectServer’s property file. Use the PasswordEncryption: ‘AES’ value. Other property values in files continued Other property values in files continued To initiate Process Automation in OMNIbus V7.2.1 using AES encryption, you must use –keyfile and –cryptalgorithm as presented here: $> nco_pad -name NCO_PA -configfile $OMNIHOME/etc/nco_pa.conf -debug 3 -authenticate PAM –keyfile $NCHOME/etc/SECURITY/keys/netcool.keygen -cryptalgorithm AES -redirectfile $OMNIHOME/log/pa_redirect.log To initiate Process Automation in OMNIbus V7.2.1 using AES encryption, you must use –keyfile and –cryptalgorithm as presented here. Encrypting a string value with the key Encrypting a string value with the key Use the nco_aes_crypt utility to encrypt a string value with the key that the nco_keygen utility generated. To encrypt a string value, run nco_aes_crypt as follows: $NCHOME/omnibus/bin/nco_aes_crypt -c cipher -k key_file string_value In this command: cipher is the algorithm that is used to encrypt the string value. Specify one of these values for cipher, based on your mode of operation: FIPS 140–2 mode: Specify AES_FIPS. Non-FIPS 140–2 mode: Specify either AES_FIPS or AES. Use AES (the default) only if you must maintain compatibility with previously encrypted passwords. If these passwords were encrypted with the tools in versions earlier than Tivoli Netcool/OMNIbus V7.2.1, use AES. Use the nco_aes_crypt utility to encrypt a string value with the key that the nco_keygen utility generated. To encrypt a string value: Run nco_aes_crypt as follows: $NCHOME/omnibus/bin/nco_aes_crypt -c cipher -k key_file string_value In this command: cipher is the algorithm that is used to encrypt the string value. Specify one of these values for cipher, based on your mode of operation: FIPS 140–2 mode: Specify AES_FIPS. Non-FIPS 140–2 mode: Specify either AES_FIPS or AES. Use AES (the default) only if you need to maintain compatibility with passwords that were encrypted using the tools provided in versions earlier than Tivoli Netcool/OMNIbus V7.2.1. Encrypting a string value with the key continued Encrypting a string value with the key continued key_file is the file path and name of the key file. This value must match that specified for the ConfigKeyFile property in the properties file. string_value is the string value that you want to encrypt. Restriction: Because of the start order, the MessageLevel property cannot currently be encrypted. The output is displayed in the console window in encrypted form and is delimited with @ symbols. You can now copy the output text, including the @ symbols, to use with the relevant properties file. The command parameters continued from the previous slide also include values: key_file which is the file path and name of the key file. This value must match that specified for the ConfigKeyFile property in the properties file. string_value which is the string value that you want to encrypt. Restriction: Because of start order, the MessageLevel property cannot currently be encrypted. The output is displayed in the console window in encrypted form and is delimited with @ symbols. You can now copy the output text, including the @ symbols, to use with the relevant properties file. Encrypting a string value with the key: example Encrypting a string value with the key: example These sample commands show how to use the nco_aes_crypt command. shell$> cd $OMNIHOME/bin shell$> ./nco_aes_crypt –o $NCHOME/etc/security/keys/encrypted_output.txt –c AES_FIPS –k $NCHOME/etc/security/keys/netcool.keygen encryptthistext123 The resultant output in the file is similar to this output format: @44:D0Bk2i1+QzfXbzzBhHTaOvjZNz0yW4VqHbBbwgsu1ao=@ You must use the encrypted value in place of any property value being encrypted, wherever needed. These sample commands show how to use the nco_aes_crypt command. The resultant output in the file is similar to this output format. You must use the encrypted value in place of any property value being encrypted, wherever needed. Encrypting a string value with the key: considerations Encrypting a string value with the key: considerations You must include the values ConfigKeyFile and ConfigCryptoAlg in any property file where you are using an encrypted value as follows: ConfigCryptoAlg: ‘AES_FIPS’ use either AES or AES_FIPS ConfigKeyFile: ‘$NCHOME/etc/security/keys/netcool.keygen’ -cryptalgorithm ‘AES_FIPS’ in the nco_pad command line You must use the command option –keyfile and –cryptalgorithm in the process automation daemon command line. A few consideration to take note of are: You must include the values ConfigKeyFile and ConfigCryptoAlg in any property file where you are using an encrypted value. You must use the command option –keyfile and -cryptalgorithm in in the process automation daemon command line. Encrypting a string value with the key: considerations continued Encrypting a string value with the key: considerations continued In your ObjectServer properties, set the value of PasswordEncryption to AES or create the new ObjectServer database instance using this command: shell$> nco_dbinit -pwdenc AES -server NCOMSA You must include the AuthUserName and Authpassword properties in probe files. Use property value encryption in either FIPS-compliant mode or non-FIPS-compliant mode. In your ObjectServer properties, set the value of PasswordEncryption to AES, or create the new ObjectServer database instance using the nco_dbinit command. You must include the AuthUserName and Authpassword properties in probe files. Use property value encryption in either FIPS-compliant mode or non-FIPS compliant mode. Training roadmap for Tivoli Netcool/OMNIbus Training roadmap for Tivoli Netcool/OMNIbus http://www.ibm.com/software/tivoli/education/edu_prd.html Feedback Feedback Your feedback is valuable You can help improve the quality of IBM Education Assistant content to better meet your needs by providing feedback. Did you find this module useful? Did it help you solve a problem or answer a question? Do you have suggestions for improvements? Click to send e-mail feedback: mailto:iea@us.ibm.com?subject=Feedback_about_aes_propertyvalue_encrypt.ppt This module is also available in PDF format at: ../aes_propertyvalue_encrypt.pdf You can help improve the quality of IBM Education Assistant content by providing feedback. Trademarks