Skip to content

Enable Password Encryption for Privacera Services#

This topic covers how you can enable encryption of secrets for Privacera services such as Privacera Portal, Privacera Dataserver, Privacera Ranger, Ranger Usersync, Privacera Discovery, Ranger KMS, Crypto, PEG, and Privacera PolicySync. The passwords will be stored safely in keystores, instead of being exposed in plaintext.

By default, all the sensitive data of the Privacera services are encrypted.

UI Configuration#

  1. Launch PM UI. For more information on how to start PM UI, click here.

  2. In the left navigation of the PM UI, navigate to Setup Environment > Internet & Security and turn on Encrypt Secrets in Keystores ?.

  3. Navigate to Setup Secrets Encryption > Configure Secrets Encryption. By default, Global Encrypt Secrets is enabled.

    Set a keystore password in Global Default Keystore Password.

  4. To install/update, go to Install in the left navigation, and click Install & Start Services.

CLI Configuration#

  1. SSH to the instance where Privacera is installed.

  2. Run the following command.

    cd ~/privacera/privacera-manager
    cp config/sample-vars/vars.encrypt.secrets.yml config/custom-vars/
    vi config/custom-vars/vars.encrypt.secrets.yml
  3. In this file set values for the following:

    Enter a password for the keystore that will hold all the secrets.  e.g. Str0ngP@ssw0rd


    If you want to encrypt data of a Privacera service, you can enter the name of the property.


    To encrypt properties used by Privacera Portal:


    To encrypt properties used by Dataserver:


    To encrypt new properties used by PolicySync, add the property in the vars.encrypt.secrets.ymlfile displayed in the New tab. And to encrypt the old properties, uncomment the property in the vars.encrypt.secrets.yml file displayed in the Old tab. For more information on the new and old properties, see PolicySync - Redshift.


    To encrypt properties used by Encryption:

    #Additional properties to be encrypted for Crypto


  4. Run the following command.

    ./ update

    For a Kubernetes configuration, you also need to run the following command:

    ./ restart
  5. To check keystores generated for the respective services.

    ls ~/privacera/privacera-manager/config/keystores