Improved VCS password encryption
The
vcsencrypt -gensecinfo command is updated to generate only an encryption key and store it in the SecInfo256 attribute in the main.cf file. The initialization vector (IV) is now generated during encryption, and then the IV and the corresponding encrypted password are stored in the new IV256List attribute as a key-value pair.
Note: You must runvcsencrypt -gensecinfobefore encrypting any passwords.
IV256List gets added to or updated in
main.cf when a user encrypts the VCS password or an agent password by using the vcsencrypt -vcs or the vcsencrypt -agent command respectively. The attribute also gets added or updated when a cluster user is added by using the hauser -add command, in case of non-secure clusters.
Note: You no longer need to runhaconf -dumpto update the configuration after any of these three commands are run. Thevcsencryptutility itself handles the update.
You can not modify the IV256List attribute by using
haconf -modify. However, you can delete stale entries from IV256List by using vcsencrypt -delkey encryptedPasswordValue.
Note: Passwords that were encrypted using the earlier mechanism get automatically decrypted in the same manner.
For details, refer to the Cluster Server Administrator's Guide.