Argus Safety uses dynamically generated encryption keys for passwords within the system. The Cryptography Key Editor allows you to generate a dynamic key and then encrypt passwords using the said key. The generated key must be installed on each application server and must be common to allow all servers to communicate with the Argus Safety database.
The key is stored in the ArgusSecureKey.ini file located in the .\Windows folder.
IMPORTANT: During a new environment installation, a key will need to be generated prior to creating a database.
During an upgrade, a key will need to be generated prior to upgrading or an existing key from the existing setup can be used to perform the database upgrade. Make sure that the password information specified in the database is consistent with the information provided in the ArgusSecureKey.ini file.
Note:
When the ArgusSecureKey.ini file is generated, there is no need to run this tool again while launching the Argus Crypto Tool. The tool should only be run again if you are resetting passwords, keys or have lost the ArgusSecureKey.ini file.When the key file is created, copy it to the .\Windows folder on all application servers (web, transaction, etc.).
Note:
Do not run the Cryptography Key Editor on each application server to generate passwords. It need only be run once during the initial system setup. Subsequent server installations must have the key manually copied to each .\Windows folder.Whether you are upgrading to Argus Safety 8.2.1 or installing a fresh instance of it, you must generate new key using the Cryptography Key Editor.
Recommendation:
Install the Argus Crypto Tool and Argus Insight Crypto Tool on the Transaction Server.You must generate the ArgusSecureKey.ini key file before running the Argus Crypto Tool.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click New.
The Generate Key screen appears.
In the Note to be added as comment field, enter a comment that will be saved in the ArgusSecureKey.ini.
This can be any form of metadata, such as the reason why this key was generated or for what environments it is used.
Enter ARGUSUSER password and Confirm password.
(Optional) Enter APR_USER password and Confirm password.
This field applies to the Argus Insight user. If Argus Insight is not installed along with Argus Safety, leave this field blank.
Click OK.
The ArgusSecureKey.ini file is created in the <Install folder>\CryptoKeyEditor\output\<DateTimeStamp>\.
Click the link in the Argus Secure Key Path dialog box to open the folder in Windows Explorer.
Click Close, I will copy it manually and copy the file manually from the window that gets opened by clicking on the link mentioned above.
To move the generated ArgusSecureKey.ini file to the .\Windows folder, click Copy to windows folder.
Run the Argus Crypto Tool to create or upgrade the database. If you run the Argus Crypto Tool before creating the key, a warning message appears that the cryptography key is required.
After setting up the application servers, copy the ArgusSecureKey.ini file from the .\Windows folder of the system, where the database is created or upgraded, and replace the .\Windows folder of each installed application server.
If the password for the database user ARGUSUSER has changed, you will need to reset the password in the ArgusSecureKey.ini file on all the servers.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click Existing.
The Key Editor Login or Re-encrypt ARGUSUSER screen appears.
Enter the ARGUSUSER password.
Enter the APR_USER password.
This field appears only when you have installed Argus Insight along with Argus Safety.
Enter the database name.
Click Re-encrypt.
A confirmation dialog appears.
Click Yes.
Copy the updated ArgusSecureKey.ini File from the .\Windows folder to all the .\Windows folder of all the application servers.
Verify that you can Log in to the Argus Safety application.
An administrator might want to change a key due to various reasons like a policy to change key every few days, or to avoid network compromise, etc.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click Existing.
The Key Editor Login or Re-encrypt ARGUSUSER screen appears.
Enter the ARGUSUSER password.
Enter the APR_USER password.
This field appears only when you have installed Argus Insight along with Argus Safety.
Enter the database name.
Click Login.
The Key Editor Options for Existing Installation screen appears.
Enter the DBA User Name and User Password.
Click Validate.
Select the Edit Key checkbox.
This enables the child checkboxes of User Key and Cookie Key.
The User Key is used for all the encrypted strings which are persisted in the database or file server.
The Cookie Key is only used to encrypt and decrypt the key.
The user has the option to change either one or both keys.
Select the checkboxes in front of the key that you want to change.
Change the Key Size drop-down value, if you wish to change the key size. Key Size is measured in bits of the key used in a cryptographic algorithm.
Click Re-Generate.
This will change the value of the checked items and the new value will be visible in the textbox.
Click Execute.
The Reason for this Action dialog box appears, prompting the user to add a reason for his action.
The text entered here is visible in the Audit Log in the Argus Safety application.
Click OK.
Check the status box to verify if the operation has been successful.
If the operation is successful and the Cryptography key is checked, then the changed key is now stored in the ArgusSecureKey.ini.
You should now copy this file from the .\Windows folder of the current machine and paste it to the .\Windows folder of all web servers.
When the user key is changed, all the encrypted strings in the database are re-encrypted using the new key.
However, there are still some other file server locations where this key change must also be applied manually. The following is a list of places where the changes must be done manually:
Items to be changed from the User Interface:
String | Description |
---|---|
Argus Services | Open Argus Safety Service Configuration: Open all the processes and enter password again. |
Cyclone | Open ESM Mapping utility and re-enter the Cyclone password. |
ESM Common User | Open ESM Mapping utility and re-enter the ESM Common User password. |
Re-enter the DBPassword in the configuration files, as explained in the following sections:
Point 2 of the Section 8.1.2.1, "RelsysWindowsService.exe.config.".
Point 5 of the Section 12.2, "Configure Dossier".
The Key Editor Options for Existing Installation screen can also be used to change the common user (ARGUS_LOGIN, ARGUS_LOGIN_I, and ARGUS_LOGIN_IPS) passwords.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click Existing.
The Key Editor Login or Re-encrypt ARGUSUSER screen appears.
Enter the ARGUSUSER password.
Enter the APR_USER password.
This field appears only when you have installed Argus Insight along with Argus Safety.
Enter the database name.
Click Login.
The Key Editor Options for Existing Installation screen appears.
Enter the DBA User Name and User Password.
Click Validate.
Check the Re-encrypt checkbox.
Enter the passwords for the common users.
Click Execute.
The Reason for this Action dialog box appears, prompting the user to add a reason for his action.
The text entered here is visible in the Audit Log in the Argus Safety application.
Click OK.
Check the status box to verify if the operation has been successful.
Generate the encrypted string from clear text, using the configured UserCryptoKey in ArgusSecureKey.ini.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click Existing.
The Key Edit Login screen appears.
Enter the ARGUSUSER password.
Enter the APR_USER password.
This field appears only when you have installed Argus Insight along with Argus Safety.
Enter the database name.
Click Login.
The Key Editor Options for Existing Installation screen appears.
Enter the DBA User Name and User Password.
Click Validate.
Check the Generate Encrypted checkbox.
Enter the password in the Clear text field.
Click Execute.
The Reason for this Action dialog box appears, prompting the user to add a reason for his action.
The text entered here is visible in the Audit Log in the Argus Safety application.
Click OK.
Check the status box to verify if the operation has been successful. If the operation is successful, the encrypted script gets displayed in the Encrypted String field.
Launch the Cryptography Key Editor.
The Key Editor Utility screen appears.
Click Existing.
The Key Editor Login screen appears.
Enter the ARGUSUSER password.
Enter the APR_USER password.
This field appears only when you have installed Argus Insight along with Argus Safety.
Enter the database name.
Click Login.
The Key Editor Options for Existing Installation screen appears.
Enter the DBA User Name and User Password.
Click Validate.
Check the Reset password for the default Administrator and System Accounts checkbox.
To set Administrator password, select the respective checkbox, and enter the parameters.
To set System user password, select the respective checkbox and enter the parameters.
Click Execute.
The Reason for this Action dialog box appears, prompting the user to add a reason for his action.
The text entered here is visible in the Audit Log in the Argus Safety application.
Click OK.
Check the status box to verify if the operation has been successful.
To generate a new key and copy it to the Windows folder, follow the steps listed in the Section 19.2.1, "Reset the ARGUSUSER Password."
To re-encrypt common user passwords, follow the steps listed in the Section 19.2.3, "Re-encrypt Common User Passwords."
Re-encrypt strings in the following locations:
String | Description |
---|---|
LDAP | Clear column LDAP_SEARCH_PASSWORD in all rows from table CFG_LDAP_SERVERS. Now open Argus Console > System Configuration > System Management > LDAP and re-enter passwords for all configurations. |
SMTP | Clear column USER_PASSWORD in all rows from table CFG_SMTP. Now open Argus Console > System Configuration > SMTP Configuration and re-enter passwords for SMTP account. |
Documentum | Clear column VALUE for row where SECTION='SYSTEM' AND KEY='DOCUMENTUM_PASSWORD' from table CMN_PROFILE_ENTERPRISE. Now open Argus Console > System Configuration > Common profile Switches to re-enter Documentum password. |
Argus Services | Open Argus Safety Service Configuration: Open all the processes and enter password again. |
Cyclone | Open ESM Mapping utility and re-enter the Cyclone password. |
ESM Common User | Open ESM Mapping utility and re-enter the ESM Common User password. |
Re-enter the DBPassword in the configuration files, as explained in the following sections:
Point 2 of the Section 8.1.2.1, "RelsysWindowsService.exe.config.".
Point 5 of the Section 12.2, "Configure Dossier".