Encryption mechanism in NiFi 2.0

[#1]

Hi,

I read from the release note that the encrypt-config.sh tool from nifi-toolkit has been removed in NiFi 2.0 due to various considerations(https://issues.apache.org/jira/browse/NIFI-13414). I am wondering is there any alternatives to this tool? We heavily relied on this encrypt-config.sh tool to encrypt plain-text passwords in nifi.properties, like nifi.sensitive.props.key, nifi.security.keyPasswd. Now with this tool gone, do we just have to accept the fact that plain-text passwords will remain plain-text?

Thanks in advance!!

[#2]

@fs_nifioneks Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi experts @mburgess @MattWho  who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

[#3]

@DianaTorres thanks for tagging the experts,  @mburgess @MattWho any insights would be much appreciated!

[#4]

NiFi will automatically encrypt sensitive properties (e.g., passwords) when you start the application. You can provide the plain-text values in the nifi.properties file, and NiFi will replace them with encrypted values upon startup.

You can verify the same as below.

cd /var/run/cloudera-scm-agent/process/

grep -Er nifi.security.keyPasswd

If you have a property like nifi.security.keyPasswd=myPassword, NiFi will encrypt it and store it in the format:

nifi.security.keyPasswd={aes-256-gcm}encryptedValue

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.

[#5]

@Kartik_Agarwal Thanks a lot for the detailed reply. Unfortunately we are not using cloudera's product line to run NiFi. But like Matt mentioned below, so far this seems like the only viable option to achieve encryption in config files, until other solution surfaces. 

[#6 · Accepted solution]

@fs_nifioneks 

Welcome to the community.

The logic behind why the encrypt-config tools were removed in Apache NiFi 2.0 is well explained in the jira NIFI-13414 you mentioned.  I am sure that the Apache community will eventually implement other more robust options for password security.

That being said, Cloudera's Cloudera Flow Management 4.x product line is  based off Apache NiFi 2.0, but will still include the encrypt-config utility in its code base to persist the existing password encryption option until more robust options replace it.  In addition, Cloudera Flow Management also keeps many (not all) Apache NiFi components processors and controller services deprecated in the Apache NiFi 2.0 releases, as well as, includes additional components only available through Cloudera only for even more dataflow design capability and connection options.  Cloudera Flow management 4.0 is available to our licensed users as a technical preview, but a full production ready release will be coming in the near future. 

You can view the Cloudera Flow Management documentation here for the Tech Preview release:
https://docs.cloudera.com/cfm/4.0.0/index.html

These Tech preview docs do not provide a component list, but the production ready release docs will.

Please help our community grow and thrive. If you found any of the suggestions/solutions provided helped you with solving your issue or answering your question, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt