Encrypt Passwords

OpenText recommends that you encrypt all passwords that you enter into a configuration file.

Create a Key File

A key file is required to use AES encryption.

  1. Open a command-line window and change directory to the M-Files Connector installation folder.

  2. At the command line, type:

    autpassword -x -tAES -oKeyFile=./MyKeyFile.ky

    A new key file is created with the name MyKeyFile.ky

CAUTION: To keep your passwords secure, you must protect the key file. Set the permissions on the key file so that only authorized users and processes can read it. M-Files Connector must be able to read the key file to decrypt passwords, so do not move or rename it.

Encrypt a Password

The following procedure describes how to encrypt a password.

  1. Open a command-line window and change directory to the M-Files Connector installation folder.

  2. At the command line, type:

    autpassword -e -tEncryptionType [-oKeyFile] [-cFILE -sSECTION -pPARAMETER] PasswordString

    where:

    Option Description
    -tEncryptionType

    The type of encryption to use:

    • AES - AES256

    For example: -tAES
    -oKeyFile

    AES encryption requires a key file. This option specifies the path and file name of a key file. The key file must contain 64 hexadecimal characters.

    For example: -oKeyFile=./key.ky

    NOTE: The full (absolute) path of the key file is included in the encrypted value, because M-Files Connector requires the key to decrypt the password. If you move or rename the key file, this path becomes invalid and you must update the encrypted value.
    -cFILE -sSECTION -pPARAMETER

    (Optional) You can use these options to write the password directly into a configuration file. You must specify all three options.

    • -c. The configuration file in which to write the encrypted password.
    • -s. The name of the section in the configuration file in which to write the password.
    • -p. The name of the parameter in which to write the encrypted password.

    For example:

    -c./Config.cfg -sMyTask -pPassword

    PasswordString The password to encrypt.

    For example:

    autpassword -e -tBASIC MyPassword
    autpassword -e -tAES -oKeyFile=./key.ky MyPassword
    autpassword -e -tAES -oKeyFile=./key.ky -c./Config.cfg -sDefault -pPassword MyPassword

    The password is returned, or written to the configuration file.

Decrypt a Password

The following procedure describes how to decrypt a password.

  1. Open a command-line window and change directory to the M-Files Connector installation folder.

  2. At the command line, type:

    autpassword -d -tEncryptionType PasswordString

    where:

    Option Description
    -tEncryptionType

    The type of encryption:

    • Basic
    • AES - AES256

    For example: -tAES
    PasswordString The password to decrypt.

    For example:

    autpassword -d -tBASIC 9t3M3t7awt/J8A
    autpassword -d -tAES PasswordString

    The password is returned in plain text.

Encrypt Secrets with HashiCorp Vault

The following procedure describes how to use the autpassword utility to encrypt secret parameter values with a HashiCorp Vault Transit secrets engine. The encryption key is stored in the Vault, and the Knowledge Discovery component can use HashiCorp Vault to decrypt the value when it is needed.

  1. In the installation folder, create a configuration file named hashicorpVaultPasswordLib.dll.cfg, and enter the following configuration parameters:

    [default]
SSLMethod=Negotiate
vault.uri=https://host.example.com:8200
vault.authentication=TOKEN
vault.token=root
vault.transit.path=transit
vault.transit.key=transit

    The parameters are described in the following table.

    Parameter Description
    vault.uri The URI of your HashiCorp Vault.
    vault.token The authentication token to use to access the vault.
    vault.transit.path and vault.transit.key These parameters define the URL of your transit secret engine. The path is the name of the secret engine you created. The key is the name of the key to use for encryption and decryption. If the key does not exist it is automatically created.

  2. Run the following command, where Secret is the parameter value to encrypt:

    autpassword -e -lhashicorpVaultPasswordLib.dll Secret

    An encrypted value is returned, that you can add to the configuration file.

    TIP: The configuration file that you created in the first step is required by the Knowledge Discovery component to decrypt the secret value, so do not delete that file and remember to include it in your backups. If you want to move your Knowledge Discovery component configuration file to another server, remember to copy hashicorpVaultPasswordLib.dll.cfg as well.