Encrypting Passwords for Customization Files on Linux

This section describes how to produce an encrypted version of a clear text password and include it in the psft_customizations.yaml file for a customized deployment for non-default users and groups on Linux. This section applies to installations with the Native OS for Linux DPKs.

Note:

You can skip this section if you are creating psft_customizations.yaml files for silent mode installations. Use clear text passwords with silent mode installations.

In general, when you run the DPK setup script, you supply several user IDs and passwords, such as the Connect ID password and operator ID password. The script encrypts the passwords that you supply and includes them in the generated YAML files in BASE_DIR/dpk/puppet/production/data. When you create a psft_customizations.yaml file, you can copy these encrypted passwords from the generated YAML files and include them in the psft_customizations.yaml file. However, the passwords for the Linux users are not prompted for, and therefore the encrypted passwords are not available in any of the generated YAML files.

Note that the successful use of the encrypted password depends on the presence of the public and private keys in the BASE_DIR/dpk/puppet directory referred to in the eyaml encrypt command. You cannot save an encrypted password and use it with a deployment with a different BASE_DIR.

This procedure assumes that you have carried out the first portion of a customized deployment, and stopped at the question “Do you want to continue with the default initialization?”

See "Completing the DPK Initialization with Customizations," Preparing the Customization Files for Linux Users and Groups.

To encrypt a password:

Run this command to source the pspuppet.sh script, which sets necessary environment variables (the command begins with a period followed by a space):
```
. BASE_DIR/psft_puppet_agent/pspuppet.sh
```
See "Completing the DPK Initialization with Customizations," Understanding the PeopleSoft Environment Customizations.

Open the BASE_DIR/dpk/puppet/hiera.yaml file and note the full path to the public and private keys:

:pkcs7_private_key: BASE_DIR/dpk/puppet/secure/keys/private_key.pkcs7.pem
:pkcs7_public_key:  BASE_DIR/dpk/puppet/secure/keys/public_key.pkcs7.pem

Run the following command in a terminal window, supplying the paths from the previous step:
```
<BASE_DIR>/psft_puppet_agent/bin/eyaml encrypt -s "<clear_password>" --pkcs7-private-key=<private_key_full_path>/<key_name> --pkcs7-public-key=<public_key_full_path>/<key_name> --output=string
```
Note:

The double-quotes around the password are required. Be sure to use the correct punctuation for the command. Note that the command uses different punctuation for the keys than the hiera.yaml file.

Note:

If your password includes an exclamation mark (!) you must enclose the entire password in double quotes surrounded by single quotes. For example, ‘”passw!ord”’.

Example for Linux:
```
BASE_DIR/psft_puppet_agent/bin/eyaml encrypt -s “password” --pkcs7-private-key=/cs1/psft/dpk/puppet/secure/keys/private_key.pkcs7.pem --pkcs7-public-key=/cs1/psft/dpk/puppet/secure/keys/public_key.pkcs7.pem --output=string
```
Copy the encrypted password from the output in the terminal window.

The encrypted text will be a long single line of letters and numbers. Be sure to copy the text in one unbroken line, with no spaces or line feeds. Here is a truncated representation of an encrypted password:
```
ENC[PKCS7,xxxxxxxxxxxxxxxxx]
```
Paste the encrypted password in the psft_customizations.yaml file, replacing the text password.

Again, the encrypted text must be a single line. Also, be sure to retain the indentation in the psft_customizations.yaml file. This is a sample psft_customizations.yaml for a new single user and existing single group:
```
---
psft_runtime_user_name: newusr3

users:
  psft_user:
    name: newusr3
    gid: 35000
    home_dir: /dpk_base/home/userhome
    password: ENC[PKCS7,xxxxxxxxxxxxxxxxx]
    remove: false
```
Use the psft_customizations.yaml file for deployment with the psft_puppet_apply script.

The DPK deployment will automatically decrypt the password from the psft_customizations.yaml and use it for deployment.