Red Hat JBoss Enterprise Application Platform Administration I

Instructions

1. Create a keystore to store the database password.

   1. Open a new terminal window and run the following commands to create a /home/student/vault.keystore file. When prompted, use password for both the keystore and certificate passwords:

      [student@workstation ~]$ keytool -genseckey -alias vault \
      -keyalg AES -storetype jceks -keysize 128 \
      -keystore /home/student/vault.keystore
      Enter keystore password:
      Re-enter new password:
      Enter key password for <vault>
      	(RETURN if same as keystore password):
      
      Warning:
      The JCEKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /home/student/vault.keystore -destkeystore /home/student/vault.keystore -deststoretype pkcs12".

      Note

      You can safely ignore the warning about the JCEKS format. Refer to the Should the password Vault keystore format be migrated from JCEKS to PKCS12 ? Red Hat Knowledge Base article at https://access.redhat.com/solutions/3388801.

      Notice that the alias value is vault. This alias refers to a keystore entry where the password is stored.

   2. Verify that you now have a file named vault.keystore in the /home/student directory.

      [student@workstation ~]$ ls | grep vault
      vault.keystore

2. Run the vault tool to encrypt the database password.

   1. Enter the following command to run the vault tool:

      [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
      [student@workstation bin]$ ./vault.sh

      At the first prompt, enter 0 to select Start Interactive Session.

   2. When prompted for the directory to store encrypted files, enter /home/student/. Note that the trailing slash is required.

   3. The Keystore URL is the path to the vault.keystore file you created in the previous step. Enter:

      /home/student/vault.keystore

   4. For the remaining prompts, use the following values:

      • Password: password

      • 8 character salt: 12345678

      • Iteration count: 50

      • Keystore Alias: vault

   5. Make a note of the management CLI command to add the vault to the JBoss EAP configuration in standalone mode.

      ********************************************
      ...output omitted...
      For standalone mode:
      /core-service=vault:add(vault-options=[("KEYSTORE_URL" => "/home/student/vault.keystore"),("KEYSTORE_PASSWORD" => "MASK-31x/z0Xn83H4JaL0h5eK/N"),("KEYSTORE_ALIAS" => "vault"),("SALT" => "12345678"),("ITERATION_COUNT" => "50"),("ENC_FILE_DIR" => "/home/student/")])
      ********************************************
      For domain mode:
      /host=the_host/core-service=vault:add(vault-options=[("KEYSTORE_URL" => "/home/student/vault.keystore"),("KEYSTORE_PASSWORD" => "MASK-31x/z0Xn83H4JaL0h5eK/N"),("KEYSTORE_ALIAS" => "vault"),("SALT" => "12345678"),("ITERATION_COUNT" => "50"),("ENC_FILE_DIR" => "/home/student/")])
      ********************************************
      WFLYSEC0057: Vault is initialized and ready for use
      WFLYSEC0058: Handshake with Vault complete
      Please enter a Digit::  0: Store a secured attribute  1: Check whether a secured attribute exists  2: Remove secured attribute  3: Exit

      The vault tool has now connected to your vault. Enter 0 to store a secured attribute.

   6. At the Please enter secured attribute value prompt, enter redhat123 as the password to connect to the MariaDB database running on your machine. Enter redhat123 twice to verify.

   7. At the prompt to enter a Vault Block, enter bkadmin.

   8. At the Enter Attribute Name prompt, enter password.

   9. Make a note of the resulting information, as prompted:

      WFLYSEC0047: Secured attribute value has been stored in Vault.
      Please make note of the following:
      ********************************************
      Vault Block:bkadmin
      Attribute Name:password
      Configuration should be done as follows:
      VAULT::bkadmin::password::1
      ********************************************

   10. The password for the MariaDB database is now in the VAULT.dat file. The data in that file is encrypted with the keys present in the vault.keystore file. Enter 3 to exit the vault tool.

3. Configure the vault by using the management CLI.

   1. Run the following commands to start the CLI:

      [student@workstation ~]$ /opt/jboss-eap-7.4/bin/jboss-cli.sh \
      -Djboss.server.base.dir=/home/student/AD248/labs/security-vault/standalone/

   2. Start the embedded server.

      [disconnected /] embed-server

      Note

      You can safely ignore the following output:

      WARNING: An illegal reflective access operation has occurred
      WARNING: Illegal reflective access by org.wildfly.extension.elytron.SSLDefinitions (jar:file:/opt/jboss-eap-7.4/modules/system/layers/base/.overlays/layer-base-jboss-eap-7.4.11.CP/org/wildfly/extension/elytron/main/wildfly-elytron-integration-15.0.26.Final-redhat-00001.jar!/) to method com.sun.net.ssl.internal.ssl.Provider.isFIPS()
      WARNING: Please consider reporting this to the maintainers of org.wildfly.extension.elytron.SSLDefinitions
      WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
      WARNING: All illegal access operations will be denied in a future release

      Refer to https://access.redhat.com/solutions/4996491.

   3. Add the vault by using the following command returned in previous step:

      [standalone@embedded /] /core-service=vault:add(vault-options=\
      [("KEYSTORE_URL" => "/home/student/vault.keystore"),\
      ("KEYSTORE_PASSWORD" => "MASK-31x/z0Xn83H4JaL0h5eK/N"),\
      ("KEYSTORE_ALIAS" => "vault"),("SALT" => "12345678"),\
      ("ITERATION_COUNT" => "50"),("ENC_FILE_DIR" => "/home/student/")])
      {"outcome" => "success"}

      Exit from the embedded server by typing exit.

   4. Start the standalone instance. Within the first few lines of the log output, you should see log events showing a security vault successfully initialized and ready.

      [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
      [student@workstation bin]$ ./standalone.sh \
      -Djboss.server.base.dir=/home/student/AD248/labs/security-vault/standalone/

      Within the first few lines of the log output, you should see log events showing a security vault successfully initialized and ready:

      06:30:14,185 INFO  [org.jboss.security] (Controller Boot Thread) PBOX00361: Default Security Vault Implementation Initialized and Ready

4. Configure the data source.

   1. Navigate to the Configuration page of the management console at http://localhost:9990. Use admin as the username, and redhat123 as the password.

   2. Click Subsystems and then click Datasources & Drivers to access the data sources subsystem.

   3. In the Datasources & Drivers column, click Datasources.

   4. In the Datasource column, click bksecurity data source.

      Then, click the arrow next to View and select Disable to disable the bksecurity data source.

      Figure 9.2: Option to disable data sources

      If a data source is currently in use, then you cannot modify the security settings.

      Reload the server by clicking Reload Required in the management console upper right bar, and click View to navigate to the bksecurity data source management page.

   5. Select the Security tab, and then click Edit.

   6. In the User Name text field, enter bkadmin.

   7. Within a ${} notation, copy and paste the configuration entry displayed at the end of the vault tool script. The Password field should appear as follows:

      ${VAULT::bkadmin::password::1}

   8. Click Save to save your changes.

   9. Click Back, and enable again the bksecurity data source.

      Reload the server by clicking Reload Required in the management console upper right bar.

5. Verify that the data source is working.

   Open the /home/student/AD248/labs/security-vault/standalone/configuration/standalone.xml file, and verify that the <password> entry for the bksecurity data source is enclosed in ${} and contains the text you provided.

   <?xml version='1.0' encoding='UTF-8'?>
   <server xmlns="urn:jboss:domain:16.0">
   ...output omitted...
     <profile>
   ...output omitted...
     <subsystem xmlns="urn:jboss:domain:datasources:6.0">
       <datasources>
   ...output omitted...
          <datasource jndi-name="java:/jboss/datasources/bksecurity-ds" pool-name="bksecurity" enabled="true">
           <connection-url>jdbc:mariadb://localhost:3306/bksecurity</connection-url>
           <driver>mariadb</driver>
           <security>
              <user-name>bkadmin</user-name>
              <password>${VAULT::bkadmin::password::1}</password>
           </security>
       </datasource>
   ...output omitted...

   Back to the management console. In the Datasource column, click the arrow next to View and select Test Connection to verify that the bksecurity data source is working.

   Figure 9.3: Option to test connection

6. Stop the running instance of JBoss EAP.