encrypt some texts in Grails Config and DataSource files - grails

Question

I need a trusted plugin or a way to encrypt some texts in Grails Config file and the DB passwords in DataSource . as they are sensitive data , such as email username and password.
Is there a powerful and trustful way to do this

Answer 1

Not through a plugin, but it's possible to hide these sensitive config settings away in external files and then set appropriate file permissions on the external files so that they are only accessible to certain users.
Within Config.groovy, there is a setting for external configuration files:
grails.config.locations = [
"classpath:${appName}/externalDb.properties",
...
]
Within DataSource.groovy, a typical arrangement may be:
dataSource {
username = "yourUser"
password = "yourPassword"
...
}
Within your externalDb.properties (which would protected by your filesystem), you would then have the username/password/email/etc. overwritten:
dataSource.username = "prodUser"
dataSource.password = "secret1!"
You can leave the Config.groovy settings in-place and they will only be overwritten if the external config file is found. You could use this to your advantage by using the external files on prod and relying on the Config.groovy settings for your dev environments; you can also apply this logic to having different external config files per environment (we use JNDI at work but I think this built-in grails feature is even easier).

Answer 2

Here is how we had done it
we were defining the password in the Config.Groovy as follows
password = DESCodec.decode("String Returned by the output of encode")
class DESCodec {
def static encode = { String target ->
def cipher = getCipher(Cipher.ENCRYPT_MODE)
return cipher.doFinal(target.bytes).encodeBase64() as String
}
def static decode = { String target ->
def cipher = getCipher(Cipher.DECRYPT_MODE)
return new String(cipher.doFinal(target.decodeBase64())) as String
}
private static getCipher(mode) {
def keySpec = new DESKeySpec(getPassword())
def cipher = Cipher.getInstance("DES")
def keyFactory = SecretKeyFactory.getInstance("DES")
cipher.init(mode, keyFactory.generateSecret(keySpec))
return cipher
}
private static getPassword() {
"testsaltString".getBytes("UTF-8")
}
static void main(args) {
println args
if(args.length == 1) {
println encode(args[0])
} else {
println decode(args[1])
}
}
}
run from the command line
groovy DESCodec.groovy 'password'
to get the ciphertext for the a string, and use the cipher text in
the config files...