...
🤔 Description
To ensure a higher level of credential security that may be required in specific industries, ACLI 11.0 .0 with the intent of helping to better secure the credentials required to access the products and systems on which ACLI actions operate.
🤔 Problem
ACLI loads the necessary system credentials it needs to do its work from configuration found in acli.properties. These credentials have historically been stored either directly in this file as plain text, or indirectly provided to the configuration by environment variable references. While indirection via the environment can help protect credentials, better solutions exist.
Despite the fact that ACLI sets restrictive file permissions on the acli.properties configuration file (since version 10.6.0), some customers want a higher level of credential security than this can provide since escape of the configuration file could result in direct compromise of the credentials it contains.
🌱 Solution
ACLI 11.0.0 introduces a new feature known as Secure Properties that introduces the Secure Properties functionality.
Secure Properties replaces the acli.properties file preventing any breach of security that could occur if the credentials in the n acli.properties were intercepted.
🌱 Solution
The Secure Properties in ACLI 11.0 provides a key-store-based credential storage solution using password based encryption (PBE). The specific key store format utilized is the Bouncy Castle provided UBER format. The use of secure properties is optional!
The intent of the secure properties key store is to protect Secure Properties key can store any value, while it prevents sensitive credentials from being stored as plain text on disk, but it can store any values you wish.
| Info |
|---|
NOTE |
Creating a key store
A new key store is created when the action setSecureProperty is run for the first time. For example:
...
| Note |
|---|
Setting your key store password as an environment variable may or may not be appropriate, depending on your risk tolerance. Doing so is a convenience, but one that comes at a cost of reduced security. You still have the advantage that if your key store file escapes your system it is strongly encrypted, but the storage of your key store password as an environment variable may make it easier to compromise your key store in a sophisticated attack. Whether you decide this is an acceptable risk is entirely at your discretion, and depends on the threat modeling under consideration by you and your organization. Use this method at your own risk. |
Actions
Use ACLI actions |
|---|
...
, part of the ACLI |
|---|
...
Secure Properties key store. |
|---|
...
| |
...
are prompted to confirm that you wish to overwrite the value. |
|
|
|
|
|
|
getSecureProperty
This action will get a secure property from the key store. By default it will only report whether or not the property was found in the key store. To also return the value, use --outputFormat 2.
removeSecureProperty
This action will remove a secure property from the key store. In order to ensure that a value is not easily removed by mistake, you will be prompted for confirmation unless you also add the --force parameter. If the key store is empty after this operation, it is automatically removed.
getSecurePropertyList
This action returns all secure properties from the key store. By default it will only report the existing property names. To also return their values, use --outputFormat 2.
clearSecureProperties
This action clears the entire secure properties key store file. In order to ensure you don’t casually destroy the file, you will be prompted for confirmation unless you also add the --force parameter.
You may be prompted for the key store password to complete this action. If you have forgotten the password and wish to start fresh, you must manually delete the key store file (see above for location information).
importSecureProperties
This action allows you to import secure properties from another key store file to your default key store. You will need the password for both the source and destination key stores. To avoid being asked to confirm overwriting properties during import, use the --replace parameter. You may also use the --include and --exclude parameters to filter the properties being imported – each of these take a regular expression value that is evaluated against the list of keys in the source key store.
This can be useful for sharing select secure properties, just be sure to not store or transmit the password with the data!
exportSecureProperties
This action allows you to export secure properties from your default key store to another key store file. You will need the password for both the source and destination key stores. To avoid being asked to confirm overwriting properties during import, use the --replace parameter. You may also use the --include and --exclude parameters to filter the properties being imported – each of these take a regular expression value that is evaluated against the list of keys in the source key store.
...