Encrypting Passwords for Customization Files on Microsoft Windows

This section describes how to produce an encrypted version of a clear text password and include it in the psft_customizations.yaml file for a customized deployment on Microsoft Windows. This section applies to installations with the Native OS for Windows DPKs.

Note:

You can skip this section if you are creating psft_customizations.yaml files for silent mode installations. Use clear text passwords with silent mode installations.

In general, when you run the DPK setup script, you supply several user IDs and passwords, such as the Connect ID password and operator ID password. The script encrypts the passwords that you supply and includes them in the generated YAML files in BASE_DIR/dpk/puppet/production/data. When you create a psft_customizations.yaml file, you can copy these encrypted passwords from the generated YAML files and include them in the psft_customizations.yaml file. If you need to encrypt a different password, you can use this procedure.

Note that the successful use of the encrypted password depends on the presence of the public and private keys in the BASE_DIR/dpk/puppet directory referred to in the eyaml encrypt command. You cannot save an encrypted password and use it with a deployment with a different BASE_DIR.

This procedure assumes that you have carried out the first portion of a customized deployment, and stopped at the question “Do you want to continue with the default initialization?”

See "Completing the DPK Initialization with Customizations."

To encrypt a password:

Open the BASE_DIR\dpk\puppet\hiera.yaml file and note the full path to the public and private keys:

:pkcs7_private_key: BASE_DIR\dpk\puppet\secure\keys\private_key.pkcs7.pem
:pkcs7_public_key:  BASE_DIR\dpk\puppet\secure\keys\public_key.pkcs7.pem

Open a command prompt and run the following command, supplying the full paths from the previous step.

Enter the command on a single line.
```
<BASE_DIR>\psft_puppet_agent\bin\eyaml encrypt -s "<clear_password>" --pkcs7-private-key=<private_key_full_path>\<key_name> --pkcs7-public-key=<public_key_full_path>\<key_name> --output=string
```
Note:

The double-quotes around the password are required. Be sure to use the correct punctuation for the command. Note that the command uses different punctuation for the keys than the hiera.yaml file.

Note:

If your password includes an exclamation mark (!) you must enclose the entire password in double quotes surrounded by single quotes. For example, ‘”passw!ord”’.

For example:
```
C:\psft\psft_puppet_agent\bin\eyaml encrypt -s “password” --pkcs7-private-key=C:\psft\dpk\puppet\secure\keys\private_key.pkcs7.pem --pkcs7-public-key=C:\psft\dpk\puppet\secure\keys\public_key.pkcs7.pem --output=string
```
Copy the encrypted password from the output in the command prompt window.

The encrypted text will be a long single line of letters and numbers. Be sure to copy the text in one unbroken line, with no spaces or line feeds. Here is a truncated representation of an encrypted password:
```
ENC[PKCS7,xxxxxxxxxxxxxxxx]
```
Paste the encrypted password in the psft_customizations.yaml file, replacing the text password.

Again, the encrypted text must be a single line. Also, be sure to retain the indentation in the psft_customizations.yaml file. This is a sample psft_customizations.yaml with an entry for the connect ID:
```
---
db_connect_id:     people
db_connect_pwd:    ENC[PKCS7,xxxxxxxxxxxxxxxxx]
```
Use the psft_customizations.yaml file for deployment with the psft_puppet_apply script.

The DPK deployment will automatically decrypt the password from the psft_customizations.yaml and use it for deployment.