DPA password encryption settings

11/21/2018 11:16 PM

3/13/2025 9:09 PM

DPA provides the ability to change the cryptographic system used to encrypt sensitive information (e.g., database login and DPA user passwords). In addition to the default encryption system used by DPA in prior versions, cryptographic options are provided that use Password-Based Encryption (PBE):

• AES 128-bit
• AES 256-bit

PBE is a process in which a cryptographic key is derived from a "passphrase". The derived key is then used for encryption and decryption operations.

Database Performance Analyzer

Configure Encryption Settings in DPA 

1. Log in to DPA as an administrator.
2. Click the Options menu. Then click the Administration tab and choose Password Encryption Settings.
   
   The DPA Password Encryption Settings page displays two options in addition to the default encryption system (AES 128-bit and AES 256-bit). These AES options use industry-accepted PBE implementations including key derivation as defined in the RSA Labs PKCS #12 v1 specification. The encryption and decryption operations use AES with Cipher Block Chaining and PKCS #7 Padding using a 128 or 256 bit key.
    
3. To change the encryption system used by DPA, select an option and enter a passphrase. Click the help link next to the Encryption Passphrase field to see a description of the passphrase and best practices for choosing a passphrase.
4. Click the Update button. DPA validates the input and, upon successful validation, re-encrypts all passwords stored in DPA.

Custom Encryption Provider 

In environments where the default options (AES 128 and 256) are not acceptable, DPA provides an option to specify a different provider and PBE system.  To do this, you must:

• Supply a provider that is compliant with the JCE API
• Supply a provider algorithm name, where the algorithm must be able to be used as both a secret key factory and a symmetric cipher

The remainder of this article describes the process to enable an alternate encryption system.

Configure alternate provider in DPA (not recommended) 

It is possible to use the Bouncy Castle provider that is installed with DPA, but specify a PBE encryption scheme that is different than the defaults provided by DPA.  If, however, you need to add files within the DPA install directory structure, the files will be removed during an DPA upgrade. 

It is therefore strongly recommended to not use the default Java installation that is shipped with DPA when employing an alternate encryption system. The reason is that several files may be added to the Java environment to enable the alternate system, and these files will not be retained after DPA is upgraded to a new version.

Configure DPA with alternate Java 

To configure DPA to use a different Java installation than is provided:

1. Download and install Java 6 or 7 on the DPA server.
2. Open the {install directory}/iwc/tomcat/ignite_config/java_loc.txt file.
3. Update the contents to point to the new installation. For example: home/java/jdk160_30/bin/java

Install the encryption provider 

If the desired provider is not the Bouncy Castle provider (which is included with DPA outside of the Java installation), the new provider must be installed as follows:

1. Obtain the desired JCE provider as a signed jar file.
2. Copy the JCE provider jar to the jre/lib/ext directory of the Java installation.
3. Enable the provider by adding it to the java.security file:

   1. Open java.security located in jre/lib/security of the Java installation.

   2. Inside this file, add a line to the security provider section similar to the existing entries (security.provider.N= <provider> where N is the next available number).

   3. Save the file.

Install unrestricted policy files

A typical Java installation has a set of policy files that restrict the cryptographic key sizes that can be used (for most algorithms, the maximum size is 128 bits). If the desired encryption system requires key sizes that exceed the restricted length, a set of unrestricted policy files must be installed. SolarWinds does not provide these files with DPA. The files and instructions on how to install them can be found at: http://www.oracle.com/technetwork/java/javase/downloads/index.html

Enable custom encryption in DPA 

The last step in the setup process is to enable the custom encryption system option in DPA. To do this, open the {install directory}/iwc/tomcat/ignite_config/idc/system.properties file and add the following line:

com.confio.ignite.security.encryption.allowCustomConfiguration=true

Save the file and restart DPA.

Use custom encryption in DPA

1. Log in to DPA as an administrator.
2. Click Options > Administration > Password Encryption Settings. You should see a new option called Custom. 
3. Click the encryption scheme.
4. Two lists display: one for the provider and another for the PBE algorithm name. Select the provider you installed. DPA lists all candidate PBE algorithms for the chosen provider. If the desired algorithm is not in the list, there is an entry in the list that allows you to specify the algorithm.
5. Click Test Provider. The test requires a passphrase. The test consists of loading the provider and running encryption and decryption operations on a test message.

How do we protect the AES passphrase?

Passwords used by DPA that are stored either in the files on the DPA server or the repository database (Password Encryption), include:

• DPA Repository admin user
• DPA Custom users
• DPA Custom alert/metric password
• Monitoring users (1 for each monitored DB instance)
• VMware vSphere monitoring user
• Active Directory or LDAP Manager Account

DPA uses default encryption for passwords stored in the files and databases in the form of hexadecimal strings. This default encryption method ensures the security of sensitive information.

Enabling AES Encryption

When a user decides to enhance security by enabling AES encryption, they must set a password for encryption during the configuration process.

Security File Creation

Upon enabling AES encryption, DPA generates a security file and backs up the previously encrypted passwords, which were secured using the default encryption method. The security file is stored under <DPA_INSTALLATION_DIRECTORY>\SolarWinds\DPA\iwc\tomcat\ignite_config\idc.

The security file contains crucial information such as the encryption passphrase, timestamp, encryption type, and more.

The encrypted passwords are also stored in the CONPRM table. With AES encryption enabled, passwords are now encrypted using the AES algorithm, providing an additional layer of security.

AES Encryption Mechanism

AES (Advanced Encryption Standard) is a symmetric block cipher, meaning it employs the same secret key for both encryption and decryption. However, the secret key is not stored explicitly in DPA, ensuring that users cannot directly decrypt the stored passwords.

Note on AES Password Usage

It's important to clarify that the AES password set during the encryption setup is not used explicitly within DPA. Instead, it serves the purpose of enabling AES encryption. The actual encryption and decryption processes occur seamlessly in the background.

Securing AES Passphrases

Length:

Opt for a long passphrase, aiming for a minimum of 12 characters. Longer passphrases generally enhance the strength of the encryption key.

Complexity:

Create a passphrase with a mix of uppercase and lowercase letters, numbers, and special symbols. Avoid using dictionary words, common phrases, or any personal information that might be easily guessable.

Periodic Passphrase Updates:

By changing the passphrase, this includes updating all associated passwords stored in the database and relevant files.