Skip to main content Skip to complementary content

Encrypting secrets stored in the Talend JobServer configuration file

Talend JobServer offers password encryption for its TalendJobServer.properties configuration file.

Information noteImportant: For Talend ESB, the configuration file is different. Follow Configuring password encryption for Talend ESB instead to implement the encryption.

About this task

By default, the encryption feature is inactive. Follow these steps to activate it:

Procedure

  1. Create an encryption key file:
    1. Navigate to <JobServer_installation>/conf/.
    2. Create a new file named aeskey.dat.
  2. Generate a Base64 encoded AES key:
    1. You can use a command like: openssl rand 32 | base64 to generate this key.
    2. Add the key to aeskey.dat in this format: aes.key=<your_generated_key>.
  3. Configure encryption:
    1. Open <JobServer_installation>/conf/TalendJobServer.properties.
    2. Set org.talend.remote.jobserver.encrypt=true.
  4. Apply changes:
    1. Save the modified files.
    2. Restart Talend JobServer.

Results

Upon startup, Talend JobServer encrypts the following passwords using the Base64 encoded secret:

  • org.talend.jmxmp.ssl.keyStorePassword
  • org.talend.jmxmp.ssl.trustStorePassword
  • org.talend.remote.server.ssl.keyStorePassword
  • org.talend.remote.server.ssl.trustStorePassword
Custom key file location:
  • To customize the key file location or name, set the encryption.keys.file system property in the start_rs.sh script.

Configuring password encryption for Talend ESB

Talend ESB uses org.talend.remote.jobserver.server.cfg for its JobServer configuration.

If you are using Talend ESB, skip the previous section and apply the following steps instead.

About this task

The encryption feature of Talend ESB is initially inactive.

Procedure

  1. Create an encryption key file:
    1. Navigate to <KARAF_HOME>/etc.
    2. Create a new file named aeskey.dat
  2. Generate a Base64 encoded AES key:

    Use a command like: openssl rand 32 | base64

    Add the key to aeskey.dat in this format: aes.key=<your_generated_key>

  3. Configure encryption:
    1. Open <KARAF_HOME>/etc/org.talend.remote.jobserver.server.cfg.
    2. Set org.talend.remote.jobserver.encrypt=true.
  4. Apply changes:
    1. Save the modified files.
    2. Restart Talend JobServer.

Results

Upon startup, Talend JobServer encrypts the following passwords using the Base64 encoded secret:

  • org.talend.jmxmp.ssl.keyStorePassword
  • org.talend.jmxmp.ssl.trustStorePassword
  • org.talend.remote.server.ssl.keyStorePassword
  • org.talend.remote.server.ssl.trustStorePassword
Custom key file location for Talend ESB:
  • To customize the key file location or name, set the encryption.keys.file system property in the trun script.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here