The daily edition.

Scope

This lesson covers the Enterprise Server Vault Facility in Rocket Enterprise Developer / Enterprise Server 12.0 for Linux/UNIX.

Enterprise Server is configured with a default vault, and components including ESCWA can store sensitive values in it automatically. A vault is a logical configuration; its provider performs the actual storage operations. The supplied default provider, mfsecretsaes, stores data encrypted in a file using AES256-CBC. Its password and optional salt are supplied through secrets.cfg, normally under $COBDIR/etc/secrets. Vault Providers The mfsecretsaes Vault Provider

That architecture creates an important security boundary: encrypting the vault file does not make secrets.cfg harmless. The configuration contains information required to read the secrets. Rocket therefore recommends restricting access to both the vault files and secrets.cfg with operating-system permissions. It also warns that changing the provider password or salt after secrets have been stored makes the earlier secrets inaccessible. Back up secrets.cfg securely before changing it, and manage such changes as recovery-sensitive configuration changes. Rocket does not support customer-written vault providers. Vault Providers

For Linux/UNIX, Rocket documents a group-based access model. Create a group—for example, mfes—containing root, the Enterprise Server administration ID, and users who must run vault-aware commands. Then assign the secrets directory to that owner and group and limit access to them:

chown -R root.mfes $COBDIR/etc/secrets
chmod -R 770 $COBDIR/etc/secrets

The directory is commonly a symbolic link into the persistent configuration area; the documented commands normally operate on its target. Accounts that start regions with casstart, including scheduler accounts, also require membership in the appropriate Rocket ES group so the processes can access required vault material. Restricting Access to the Vault Facility

Administration is performed with mfsecretsadmin, which supports reading, writing, listing, deleting, and migrating secrets. -vault selects a named source vault, while -config selects a non-default secrets.cfg. For example, Rocket documents storing credentials for the OpenESQL ODBC preprocessor as:

mfsecretsadmin write Microfocus/ODBCECM/MFV_MySecretName MyUser.MyPassword

Migration can copy secrets to another configured vault; adding -move deletes each source secret after it has been successfully migrated. The mfsecretsadmin Utility

Takeaway: The Vault Facility protects stored values cryptographically, but operational security depends equally on preserving and tightly restricting secrets.cfg, because it supplies the material required to decrypt them.