-
Notifications
You must be signed in to change notification settings - Fork 1
Secure
The drm-cli provides you a built-in sensitive data encryption, such as encrypting connection strings.
This is usually done by explicitly defining an encryption key at installation time, using install.py.
The encryption key is very important factor in the drm-cli as it is used as an authenticator.
This means that without the encryption key, the drm_deploy.py will not work.
Note!!! The drm_crypto is an individual utility, located in the drm-cli directory.
This means that if multiple instances of the drm-cli are installed, each will have its own drm_crypto.
The drm-cli installer is a python script project.
Hence, python must be installed in advanced on the drm-cli installer host.
To run the drm_crypto, run script drm_crypto.py within the installed drm-cli.
python3 ./drm_crypto.pyThe drm_crypto is an inline parameters options utility.
This provides you the ability to automate your actions, if it's desired.
For instance, inline options are used in pipeline executions.
To see all optional parameters, use the -help option.
python3 ./drm_crypto.py -help-
Encrypt (--e, --encrypt)
This flag is one of the two optional operations of thedrm_crypto.
It means we want to encrypt a clear text using thedrm-clicurrent encryption key.
Common use case:
- We want to change the connection string to a target, while the
drm-cliis encrypted.
This way, we can encrypt a clear texted connection string & overwrite the existing in thedrm-climanually.
-
Change encryption key (--c, --changepassword)
This flag is one of the two optional operations of thedrm_crypto.
It means we want to change the installeddrm-cliencryption key.
Common use cases:
- We want to change the
drm-cliencryption key. - We want to encrypt the not encrypted
drm-cli. - We want to decrypt an encrypted
drm-cli.
-
Text (--t, -text)
This parameter is used only when flagEncryptis is turned on. It will contain the clear text we want to encrypt using thedrm-clicurrent encryption key. -
Encryption key (-p, -encryption_key)
This parameter represents the currentdrm-cliencryption key. -
New encryption key (-n, -new_encryption_key)
This parameter is used only if flagchangepasswordis used and represents the newdrm-cliencryption key.
Note!!! The new encryption key must meet with the encryption key policy.
Encryption policy:
- Minimum 8 characters.
- The alphabet must be between [a-z].
- At least one alphabet should be of Upper Case [A-Z].
- At least 1 number or digit between [0-9].
- At least 1 special character such as !@#...
drm_crypto verification
NEED TO ADD!!!
That's it! it's simple as that :)
The drm_crypto is the drm-cli cryptographic utility that allows you to do the following actions:
- Encrypt not encrypted
drm-cli. - Decrypt an encrypted
drm-cli. - Change
drm-cliencryption key. - Encrypt text using the encryption key (Manually change connection string in an encrypted
drm-cli).
python3 ./drm_crypto.py --encrypt -t "Server=.;User Id=drm;Password=drm;Encrypt=False;" -p "my-encryption-key"In the following example, we want to encrypt the following connection string using the current encryption key.
The returned encrypted value can overwrites the existing connection string within the drm-cli manually.
python3 ./drm_crypto.py --changepassword -p none -n "my-new-encryption-key"In the following example, we use none as the current encryption key, as it was not encrypted and set a new encryption key.
python3 ./drm_crypto.py --changepassword -p "my-encryption-key" -n noneIn the following example, we use none as the new encryption key, while providing the current encryption key for decryption.
python3 ./drm_crypto.py --changepassword -p "my-old-encryption-key" -n "my-new-encryption-key"In the following example, we use the old encryption key for decryption the drm-cli, while using the new one to re-encrypt it.