Encryption mechanism in NiFi 2.0

Question

Hi,I read from the release note that the encrypt-config.sh tool from nifi-toolkit has been removed in NiFi 2.0 due to various considerations(https://issues.apache.org/jira/browse/NIFI-13414). I am wondering is there any alternatives to this tool? We heavily relied on this encrypt-config.sh tool to encrypt plain-text passwords in nifi.properties, like nifi.sensitive.props.key, nifi.security.keyPasswd. Now with this tool gone, do we just have to accept the fact that plain-text passwords will remain plain-text?Thanks in advance!!

MattWho · Accepted Answer

@fs_nifioneks Welcome to the community.The logic behind why the encrypt-config tools were removed in Apache NiFi 2.0 is well explained in the jira NIFI-13414 you mentioned.  I am sure that the Apache community will eventually implement other more robust options for password security.That being said, Cloudera's Cloudera Flow Management 4.x product line is  based off Apache NiFi 2.0, but will still include the encrypt-config utility in its code base to persist the existing password encryption option until more robust options replace it.  In addition, Cloudera Flow Management also keeps many (not all) Apache NiFi components processors and controller services deprecated in the Apache NiFi 2.0 releases, as well as, includes additional components only available through Cloudera only for even more dataflow design capability and connection options.  Cloudera Flow management 4.0 is available to our licensed users as a technical preview, but a full production ready release will be coming in the near future. You can view the Cloudera Flow Management documentation here for the Tech Preview release:https://docs.cloudera.com/cfm/4.0.0/index.htmlThese Tech preview docs do not provide a component list, but the production ready release docs will.Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.Thank you,Matt

Kartik_Agarwal · Answer

NiFi will automatically encrypt sensitive properties (e.g., passwords) when you start the application. You can provide the plain-text values in the nifi.properties file, and NiFi will replace them with encrypted values upon startup.

You can verify the same as below.

cd /var/run/cloudera-scm-agent/process/ grep -Er nifi.security.keyPasswd

If you have a property like nifi.security.keyPasswd=myPassword, NiFi will encrypt it and store it in the format:

nifi.security.keyPasswd={aes-256-gcm}encryptedValue

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.