Skip to content

rabbitmq jasypt encryption update #669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DaanHoogland wants to merge 1 commit into
base: 4.22
Choose a base branch
from
+26 −6
Open

rabbitmq jasypt encryption update #669

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions source/adminguide/events.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,10 +162,20 @@ changes can control the behaviour.

The ``eventNotificationBus`` bean represents the
``org.apache.cloudstack.mom.rabbitmq.RabbitMQEventBus`` class.

If you want to use encrypted values for the username and password, you have to include a bean to pass those
as variables from a credentials file.

.. note::
Older versions of this guide referenced
``org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer``, which comes
from the ``jasypt-spring3`` artifact. That artifact is not shipped with CloudStack and is
not compatible with the Spring 5 used since CloudStack 4.x, so beans referencing it fail
to load with a ``ClassNotFoundException``. Use
``com.cloud.utils.crypt.EncryptablePropertyPlaceholderConfigurer`` instead, which ships
with CloudStack and works the same way. This bean also expects encrypted values to be
wrapped as ``ENC(...)``, matching the convention used elsewhere in CloudStack.

Comment on lines +169 to +178

@DaanHoogland DaanHoogland Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this might not be needed

Suggested change
.. note::
Older versions of this guide referenced
``org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer``, which comes
from the ``jasypt-spring3`` artifact. That artifact is not shipped with CloudStack and is
not compatible with the Spring 5 used since CloudStack 4.x, so beans referencing it fail
to load with a ``ClassNotFoundException``. Use
``com.cloud.utils.crypt.EncryptablePropertyPlaceholderConfigurer`` instead, which ships
with CloudStack and works the same way. This bean also expects encrypted values to be
wrapped as ``ENC(...)``, matching the convention used elsewhere in CloudStack.

A sample is given below

.. code:: bash
Expand All @@ -191,29 +201,39 @@ changes can control the behaviour.
</bean>

<bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
<property name="algorithm" value="PBEWithMD5AndDES" />
<property name="algorithm" value="PBEWITHHMACSHA512ANDAES_256" />
<property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
</bean>

<bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
<property name="config" ref="environmentVariablesConfiguration" />
<property name="ivGenerator">
<bean class="org.jasypt.iv.RandomIvGenerator" />
</property>
</bean>

<bean id="propertyConfigurer" class="org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer">
<bean id="propertyConfigurer" class="com.cloud.utils.crypt.EncryptablePropertyPlaceholderConfigurer">
<constructor-arg ref="configurationEncryptor" />
<property name="location" value="classpath:/cred.properties" />
</bean>
</beans>


Create a new file in the same folder called ``cred.properties`` and the specify the values for username and password as jascrypt encrypted strings
Create a new file in the same folder called ``cred.properties`` and specify the values for
username and password as jasypt encrypted strings, wrapped as ``ENC(...)``.

Sample, with ``guest`` as values for both fields:

.. code:: bash

username=nh2XrM7jWHMG4VQK18iiBQ==
password=nh2XrM7jWHMG4VQK18iiBQ==
username=ENC(nh2XrM7jWHMG4VQK18iiBQ==)
password=ENC(nh2XrM7jWHMG4VQK18iiBQ==)

``PBEWithMD5AndDES``, used in earlier releases of this guide, is a weak algorithm and should
not be used for new deployments; ``PBEWITHHMACSHA512ANDAES_256`` above is a stronger,
future-proof alternative. Use the ``jasypt`` CLI tools (or any tool using the jasypt library)
with the same algorithm, IV generator and ``APP_ENCRYPTION_PASSWORD`` to produce the
encrypted values for ``cred.properties``.
Comment on lines +232 to +236

@DaanHoogland DaanHoogland Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
``PBEWithMD5AndDES``, used in earlier releases of this guide, is a weak algorithm and should
not be used for new deployments; ``PBEWITHHMACSHA512ANDAES_256`` above is a stronger,
future-proof alternative. Use the ``jasypt`` CLI tools (or any tool using the jasypt library)
with the same algorithm, IV generator and ``APP_ENCRYPTION_PASSWORD`` to produce the
encrypted values for ``cred.properties``.
``PBEWithMD5AndDES``, used in earlier releases of this guide, is a weak algorithm and should
At least ``PBEWITHHMACSHA512ANDAES_256`` or stronger algorithms should be used. Use the ``jasypt`` CLI tools (or any tool using the jasypt library)
with the same algorithm, IV generator and ``APP_ENCRYPTION_PASSWORD`` to produce the
encrypted values for ``cred.properties``.



#. Restart the Management Server.
Expand Down
Loading