C Security Utilities Command-Line Reference

C.1.1 cssconfig Syntax

cssconfig -p propertyfile [-c configfile] -i inputkeyfile [-d]

where:

• propertyfile is a file that contains security configuration properties. This option is required. property file provided by user to define what configuration s/he wants. See Example 4-1 for an example.

• configfile is the name of the generated file. This property is optional; default value is security.xml.

• inputkeyfile is the fully qualified name of the input key file used to generate the security configuration file. Set this option to the security-key.dat file in the config directory.

• -d enables debugging.

C.2.1 encryptMSAConfig Syntax

encryptMSAConfig directory XML_file msainternal.dat_file

where:

• directory refers to the directory that contains the XML file which in turn contains a cleartext <password> element.

• XML_file refers to the name of your XML file.

• msainternal.dat_file parameter refers to the location of the .msainternal.dat file associated with your domain; this file is located in the ORACLE_CEP_HOME/user_projects/domains/DOMAIN/SERVER directory, where ORACLE_CEP_HOME is the main Oracle CEP installation directory, such as d:\oracle_cep, DOMAIN refers to the domain directory (such as myDomain), and SERVER refers to the server instance (such as myServer).

For example:

prompt> pwd
C:\OracleCEP\user_projects\domains\ocep_domain\defaultserver
prompt> C:\OracleCEP\ocep_11.1\bin\encryptMSAConfig.cmd . config\config.xml .msainternal.dat

After you run the command, the value of the password element in XML_file will be encrypted.

C.3.1 GrabCert Syntax

java GrabCert host:secureport [-alias=alias] [-noinput] [truststorepath]

where:

C.3.2 Examples of Using GrabCert

For example:

prompt> java GrabCert ariel:9003 -alias=ariel evstrust.jks

For other examples, see Section 4.5.2, "How to Configure SSL in a Multi-Server Domain for Oracle CEP Visualizer".

C.4.1 passgen Syntax

passgen [-a algorithm] [-s saltsize] [-h] [-?] [password]*

where:

-a

-s

-h, -?

password

The Unix version of this utility starts with the #!/bin/ksh directive. On most Unix systems, this forces the Korn Shell program to be used when using the utility. If the ksh program is not present in the bin directory or if the shell language used cannot properly execute the utility, run the utility as shown below:

$PATH_TO_KSH_BIN/ksh -c passgen.sh

where PATH_TO_KSH_BIN is the fully qualified path to the ksh program.

C.4.2 Examples of Using passgen

The following sections provide examples that use the passgen utility:

• Section C.4.2.1, "Using passgen interactively"

• Section C.4.2.2, "Providing a Password on the Command Line"

$ passgen
Password ("quit" to end): maltese
{SHA-1}LOtYvfQZj++4rV50AKpAvwMlQjqVd7ge
Password ("quit" to end): falcon
{SHA-1}u7NPQfgkHISr0tZUsmPrPmr3U1LKcAdP
Password ("quit" to end): quit
{SHA-1}2pPo4ViKsoNct3lTDoLeg9gHYZwQ47sV

$ passgen maltese falcon
{SHA-1}g0PNXmJW0OBtp/GkHrhNAhpbjM+capNe
{SHA-1}2ivZnjnKD9fordC1YFkrVGf0DHL6SVP1

C.5.1 Generating a File-Based Provider Configuration File

Use the following command line options to generate a file-based security provider configuration file.

secgen -F [-o outputfile] [-i inputkeyfile] [-e] [-P PropertyFilePath]

where:

-F

-o

-i

-e

-P

C.5.2 Generating a Key File

Use the following command line options to generate a security key file.

secgen [-k] [-o outputfile] 

where:

-k

-o

C.5.3 Using the secgen Properties File

When running secgen, you can use the -P option to specify a property file to customize provider configurations. A SecGenTemplate.properties template file is located in ORACLE_CEP_HOME/ocep_11.1/bin where ORACLE_CEP_HOME is the main installation directory of Oracle CEP, such as /oracle_cep.

You specify cleartext passwords the property file; however, these passwords will be stored encrypted in the generated configuration file.

The following example shows a property file used for file based provider customization:

#File based provider related
file.atn.file.store.path=myfileatnstore.txt
file.atn.file.store.password=firewall
file.atn.user.password.style=HASHED
file.atn.file.store.encrypted=true
file.atz.file.store.path=filatz
file.atz.file.store.password=firewall
file.rm.file.store.path=filerm
file.rm.file.store.password=firewall
file.cm.file.store.path=filecm
file.cm.file.store.password=firewall

The legal values for file.atn.user.password.style are:

• HASHED

• REVERSIBLEENCRYPTED

C.5.4 Examples of Using secgen

The following example shows how to use the secgen utility to generate a key file with the name myKeyFile.dat:

prompt> secgen -k -o myKeyFile.dat

The following example shows how to use the secgen utility to generate a file-based security provider configuration file named myConfigFile.xml which also uses the previously generated key file, myKeyFile.dat, and a properties file named mySecGen.properties:

prompt> secgen -F -i myKeyFile.dat -o myConfigFile.xml -P  c:\msa\myMSAConfig\mySecGen.properties

C.5.5 Limitations of secgen

Windows operating systems must use the .cmd version of this utility, Unix platforms should use the .sh version.

The Unix version of this utility starts with the #!/bin/ksh directive. On most Unix systems, this forces the Korn Shell program to be used when using the utility. If the ksh program is not present in the bin directory or if the shell language used cannot properly execute the utility, run the utility as shown below:

prompt> $PATH_TO_KSH_BIN/ksh -c secgen.sh

where PATH_TO_KSH_BIN is the fully qualified path to the ksh program.