37. DataSource DB Password 암호화(JBoss 7)

https://docs.redhat.com/ko/documentation/red_hat_jboss_enterprise_application_platform/7.4/html/configuration_guide/datasource_security

12.10. 데이터 소스 보안 | Configuration Guide | Red Hat JBoss Enterprise Application Platform | 7.4 | Red Hat Documentati

 

PicketBox 암호화 (java 11이하 사용 필요)

 

1. 경로에 암호화 스크립트 생성

둘 중에 마음에 드는걸로 사용

 

enc-passwd.sh

. ./env.sh 

export CLASSPATH=$JBOSS_HOME/modules/system/layers/base/org/picketbox/main/picketbox-5.0.3.Final-redhat-00007.jar:$JBOSS_HOME/modules/org/jboss/logging/main/jboss-logging-3.4.1.Final-redhat-00001.jar:$CLASSPATH

if [ -z "$1" ]; then
    echo -n "DATASOURCE_PASSWORD: "
    read -s INPUT_PASSWORD
    echo ""
else
    INPUT_PASSWORD=$1
    echo "DATASOURCE_PASSWORD: $INPUT_PASSWORD"
fi

$JAVA_HOME/bin/java org.picketbox.datasource.security.SecureIdentityLoginModule "$INPUT_PASSWORD"

 

enc-passwd2.sh

#!/bin/bash

. ./env.sh

picketbox=`find ${JBOSS_HOME}/ -type f -name "picketbox*" | sort | head -n 1`
jboss_logging=`find ${JBOSS_HOME}/ -type f -name "jboss-logging*" | head -n 1`

module_name=org.picketbox.datasource.security.SecureIdentityLoginModule

export CLASSPATH=${picketbox}:${jboss_logging}

if [ -d "$JAVA_HOME" ]; then

    read -s -p "Input Database Password : " dbpassword
    echo

    ${JAVA_HOME}/bin/java -cp ${CLASSPATH} ${module_name} ${dbpassword}

else

    echo "JAVA is not installed. Please install and try again."

fi

 

2. 스크립트 실행하고 db password 입력

Encoded password 확인

 

3. 새 보안 도메인 생성

/subsystem=security/security-domain=${security-domain_name}:add(cache-type=default)
/subsystem=security/security-domain=${security-domain_name}/authentication=classic:add(login-modules=[{code=org.picketbox.datasource.security.SecureIdentityLoginModule,flag=required,module-options={userName=sa, password=sa}}])

ex)
/subsystem=security/security-domain=Postgres_enc:add(cache-type=default)
/subsystem=security/security-domain=Postgres_enc/authentication=classic:add(login-modules=[{code=org.picketbox.datasource.security.SecureIdentityLoginModule,flag=required,module-options={userName=testuser, password=32ed8a51374da351393f50fc153ed8ba}}])

 

※ 붉은색 표시 부분은 환경에 따라 변경

 

4. 생성한 보안 도메인으로 security 값 변경

<security> 태그 내의 <user-name>, <password> 태그 삭제 후 <security-domain> 태그 생성

변경 전)

 

변경 후)

 

5. 서버 재기동 후 데이터소스 커넥션 확인