Encrypting Tomcat passwords in the server.xml file
You can add extra security to your Crowd instance by encrypting passwords used to configure the connectors in the Tomcat’s server.xml file.
This solution is an obfuscation, which doesn’t assure real security. Crowd still needs to use the plain-text passwords to connect to your database, so your configuration will contain all the information needed to decrypt the password. An attacker could act as Crowd to obtain the password. We recommend that you additionally secure the server where Crowd and its database reside.
Protocols used by Crowd
Crowd provides the following protocols that extend the Tomcat protocols with support for password encryption. You will need to choose one of those protocols in the server.xml file.
Supported attributes for password encryption
Encrypt and use the passwords in the server.xml file
Complete the following steps to encrypt your passwords, and then use them in the server.xml file.
Encrypt your passwords
To encrypt your passwords:
java -cp "./*" com.atlassian.secrets.cli.tomcat.TomcatEncryptionTool
When prompted, enter the password you want to encrypt.
The encryption tool will generate two files:
encryptionKey_***. Move those files to a safe location accessible by Crowd. If you’re running a multi-node Crowd configuration, the files must be in a directory accessible by all nodes, for example
Reusing the encryption key
All encrypted passwords that you’ll provide for a single connector in the server.xml file need to be encrypted using the same
encryptionKey. To reuse the
encryptionKey created by the encryption tool, you can run the following command:
java -jar crowd-tomcat-encryption-utils-<your crowd version>.jar <path to encryptionKey_***>
This command will also prompt you for a password and then encrypt this password using the same
Use your encrypted passwords in the server.xml file
To use the encrypted passwords in your Tomcat configuration, you need to specify the following properties for the connector:
protocol- use one of the protocols listed above
encryptionKey- specify a path to the encryptionKey file
Then, you can provide the path to the encrypted password files instead of plain-text passwords in the Tomcat configuration.
The following snippet shows an example configuration that uses the
Http11NioProtocolWithPasswordEncryption protocol with the encrypted
<Connector port="8443" protocol="com.atlassian.secrets.tomcat.protocol.Http11NioProtocolWithPasswordEncryption" (...) keystoreFile="/var/secrets/keystore/keystore" keystorePass="/var/secrets/keystore/encryptedKeystorePass" keyAlias="tomcat" keyPass="/var/secrets/keystore/encryptedKeyPass" productEncryptionKey="/var/secrets/encryptionKey" />
Note that, as mentioned earlier, you must use the same
encryptionKey_*** to encrypt all passwords used for a specific connector, as you can specify only one encryption key. Different connectors can use different keys and protocols.