Encrypting Passwords in Your LYNX-APP Config File (Linux)

As part of your LYNX-APP installation, you may wish to encrypt passwords in the configuration file (application.properties).

These steps are for configuration on a Linux server. For Windows instructions, see Encrypting Passwords in Your LYNX-APP Config File (Windows).

Create an Environment or Shell Variable

• Choose an appropriate encryption password (consider your organization's guidelines if applicable).
• For this example we will use an encryption password of RADIO_BLUE_LAPTOP.
• Set a shell or environment variable called LYNX_ENCRYPT_PASSWORD with the desired value.
• If you use a shell variable, you may need to use the EXPORT command to make it available to Lynx.

Review Jasypt Deployment

Your distribution may have included none, some, or all of the needed Jasypt files. To proceed with the next steps, you will need encrypt.sh and decrypt.sh scripts.

You may need to retrieve the Jasypt package through your package manager or download and install the Jasypt files manually. (See installation instructions below.)

Installing Jasypt

• Download the Jasypt distribution zip file from jasypt.org.
• Create a suitable installation target for this application.

• The most suitable location may depend on best practices for your Linux/Unix Distribution. Example:

  • /usr/local/bin/jasypt/
    

• Unzip files from the Jasypt distribution zip to the target directory.

Review Execution Permissions

• Encryption and decryption of values may be performed through two scripts:
  • encrypt.sh
  • decrypt.sh
• Consider if you will need to change permissions to allow these scripts to execute. Example:
  • chmod +x encrypt.sh
  • chmod +x decrypt.sh

Encrypt Values

• Recall the encryption password chosen above.
• Encrypt your two passwords (Lynx-WS password and SIS DB Lynx schema password) using the encrypt script. Example:
  • ./encrypt.sh input=My-Password-Here password=RADIO_BLUE_LAPTOP algorithm=PBEWITHSHA1ANDDESEDE

After reviewing the encrypt script output, you might use copy-paste, a redirection operator, the tail command, etc to output the encrypted password into the config file.

Update the Lynx-APP Configuration

• Navigate to ~lynx-app/config
• Open application.properties for editing

• Uncomment this line (remove # sign):

  • # jasypt.encryptor.password=${LYNX_ENCRYPT_PASSWORD:}

• Above that line, add the following:
  • jasypt.encryptor.algorithm=PBEWITHSHA1ANDDESEDE 

• Enter your encoded passwords between the matching set of parentheses:

  • lynx-password=ENC(...)

  • db-password=ENC(...)

• Comment out the regular password assignment rows by adding a # sign (or remove them entirely)

  • # lynx-password=

  • # db-password=

Test the Encrypted Password

• Restart the LYNX background process

  • Stop with stopBackground.sh first if necessary
  • Start with runBackground.sh
• Verify the process is running with a suitable command. Example:
  • ps aux | grep lynx
  • This command might return a line for the grep, as well as a line indicating the application is running ( ...lynx-app.jar ):

user      2494  6.9  8.5 2584496 169848 pts/0  Sl   11:47   0:09 java -jar -Dmode=TEST lynx-app.jar
user      2584  0.0  0.0 119724  1052 pts/0    S+   11:50   0:00 grep --color=auto lynx

• The LYNX-APP may start correctly, but stop itself if there is an error, such as a network connectivity error. Ensure the process is still running after a few moments.

• If the LYNX-APP starts correctly and continues to run, verify the LYNX Dashboard web page indicates "APP OK" and no errors are presented. Example:

  • https://lynx.collegenet.com/INSTANCE-NAME

• If LYNX does not start correctly, check the ~lynx-app/logs/ folder to investigate possible causes.

• If LYNX is running properly, this process is complete.