Red Hat JBoss Enterprise Application Platform Administration I

The JBoss EAP vault utilizes a certificate stored in the keystore as an encryption key for the vault as a whole. To initialize the JBoss EAP vault, you must create the Java keystore. The following is the syntax used to create a private key, a certificate and to store them in a keystore:

keytool -genseckey -alias <alias> \
-keyalg <algorithm> -storetype <type> -keysize size \
-keystore <filepath>

[student@workstation ~]$ keytool -genseckey -alias vault \
-keyalg AES -storetype jceks -keysize 128 \
-keystore /home/student/vault.keystore

After running the command, you are prompted for a keystore password. The command creates the keystore file at the /home/student/vault.keystore directory.

JBoss EAP provides a vault tool located in the $JBOSS_HOME/bin/vault.sh script. This script enables you to initialize the vault and manage it.

You can initialize the JBoss EAP vault interactively, by providing each parameter one at a time, or by providing all of the parameters initially.

The following is an example of the syntax used to initialize the vault:

vault.sh --keystore KEYSTORE_URL --keystore-password KEYSTORE_PASSWORD \
--alias KEYSTORE_ALIAS --vault-block VAULT_BLOCK --attribute ATTRIBUTE \
--sec-attr SEC-ATTR --enc-dir ENC_FILE_DIR --iteration ITERATION_COUNT \
--salt SALT

The following parameters are required to initialize the vault:

The following is an example with the parameters populated:

[student@workstation ~]$ vault.sh --keystore /home/student/vault.keystore \
--keystore-password password --alias vault --vault-block bookstore \
--attribute password --sec-attr redhat --enc-dir /home/student/
--iteration 50 --salt 12345678

After initializing the vault the tool creates a VAULT.dat file, which is the unified storage for the secured data. In a JBoss EAP managed domain you must copy the VAULT.dat file to all the secondary host controllers in the domain.

After running the vault.sh command, an XML definition of the vault is displayed, which needs to be added to the server configuration files.

The following is an example of the XML that you must add to either the standalone.xml or host.xml configuration file directly before the <management> section:

<vault>
  <vault-option name="KEYSTORE_URL" value="/home/student/vault.keystore"/>
  <vault-option name="KEYSTORE_PASSWORD" value="MASK-31x/z0Xn83H4JaL0h5eK/N"/>
  <vault-option name="KEYSTORE_ALIAS" value="vault"/>
  <vault-option name="SALT" value="12345678"/>
  <vault-option name="ITERATION_COUNT" value="50"/>
  <vault-option name="ENC_FILE_DIR" value="/home/student/"/>
</vault>

The final step is to replace the sensitive data with a reference to the attribute in the vault. The vault.sh command provides the exact syntax necessary to reference the secured attribute after all of the parameters are provided. Using the previous example, the vault command generated the following:

VAULT::bookstore::password::1

In order to use this reference, use the following syntax within the server configuration:

${VAULT::VAULT_BLOCK::ATTRIBUTE_NAME::1}

The following can replace the previous password in the server configuration for the bookstore data source password:

${VAULT::bookstore::password::1}

After replacing the password for the data source, the server configuration for the data source is similar to the following:

 <datasource jndi-name="java:jboss/datasources/nookdyotr" ...>
                    <connection-url>...</connection-url>
                    <driver>mysql</driver>
                    <security>
                        <user-name>bkadmin</user-name>
                        <password>${VAULT::bookstore::password::1}</password>
                    </security>
 </datasource>