Password commands

OceanBase Deployer (obd) supports encrypting cluster passwords since V3.2.0. This topic describes the commands related to password encryption. You can specify the -h or --help option in a command to query the help information of its subcommands. You can also specify the -v or --verbose option to query the execution details of a command that returns an error.

obd pwd encrypt

You can run this command to enable or disable password encryption.

obd pwd encrypt [enable | disable]

You can use the enable keyword to enable password encryption. If no passkey has been specified before, you must specify one when you enable this feature. If you have specified a passkey by using the obd pwd set-epk command, you must provide the passkey for verification. When you run the obd cluster display command to view cluster information after password encryption is enabled, the cluster passwords are displayed in ciphertext. To view the passwords in plaintext, you must add the --epk or --encryption-passkey option to the obd cluster display command and enter the passkey.

You can use the disable keyword to disable password encryption. To disable this feature, you must provide the passkey for verification. You can provide the passkey by using the --epk or --encryption-passkey option, or enter it when prompted in the command output.

Examples

• Enable password encryption

  obd pwd encrypt enable
  

  If no passkey has been configured before, the command output is as follows:

  First time setting the encryption passkey. please enter the encryption passkey:
  Please enter the encryption passkey again:
  First time setting the encryption passkey successful!
  Encrypt password ok
  Trace ID: b96a5f82-0ec2-11f0-8b44-00163e49899d
  If you want to view detailed obd logs, please run: obd display-trace b96a5f82-0ec2-11f0-8b44-00163e49899d
  

  If you run the obd cluster display command to view cluster information after password encryption is enabled, the output is as follows, where the passwords after the -p option are displayed in ciphertext.

  +-------------------------------------------------+
  |                 oceanbase-ce                    |
  +---------------+---------+------+-------+--------+
  | ip            | version | port | zone  | status |
  +---------------+---------+------+-------+--------+
  | 10.10.10.1    | 4.3.5.0 | 2881 | zone1 | ACTIVE |
  +---------------+---------+------+-------+--------+
  obclient -h10.10.10.1 -P2881 -uroot -p'********' -Doceanbase -A
  
  +----------------------------------------------------------------+
  |                           obproxy-ce                           |
  +------------+------+-----------------+-----------------+--------+
  | ip         | port | prometheus_port | rpc_listen_port | status |
  +------------+------+-----------------+-----------------+--------+
  | 10.10.10.2 | 2883 | 2884            | 2885            | active |
  +------------+------+-----------------+-----------------+--------+
  obclient -h10.10.10.2 -P2883 -uroot@proxysys -p'********' -Doceanbase -A
  

• Disable password encryption

  obd pwd encrypt disable --epk=******
  

obd pwd set-epk

You can run this command to specify a passkey or change the passkey.

obd pwd set-epk <new decryption passkey>

The following table describes the options in the command.

Examples

• Specify a passkey

  obd pwd set-epk 12345
  

  Here is an example of setting the passkey to 12345. If the output is as follows, the passkey is successfully set. If you run the obd pwd encrypt enable command to enable password encryption, you must provide the passkey specified here for verification.

• Change the passkey

  obd pwd set-epk 123 -c 12345
  

  Here is an example of changing the passkey from 12345 to 123. If the output is as follows, the passkey is successfully changed.

  Check encryption passkey.
  Update encryption passkey successful.
  Trace ID: fb5e2608-0ec2-11f0-a28b-00163e49899d
  If you want to view detailed obd logs, please run: obd display-trace fb5e2608-0ec2-11f0-a28b-00163e49899d
  

• Forcibly change the passkey

  obd pwd set-epk 123 -f
  

  Here is an example of forcibly changing the passkey to 123. The output is as follows:

  Please input username with sudo privileges. (default: root):
  please input root password:
  Update encryption passkey successful.
  Trace ID: 4f3d41f0-0ec3-11f0-919b-00163e49899d
  If you want to view detailed obd logs, please run: obd display-trace 4f3d41f0-0ec3-11f0-919b-00163e49899d