# Encrypting Configuration Files

## Overview <a href="#id-1fb3f9ab-535e-46e3-b4bc-c5d96c8a60e5" id="id-1fb3f9ab-535e-46e3-b4bc-c5d96c8a60e5"></a>

{% hint style="info" %}
This feature was introduced in NetObserv 7.21.0
{% endhint %}

NetObserv can encrypt configuration files (decrypting them on startup to read them).

Files encrypted with this feature:

* NetObserv Flow: flowcoll.yml, Azure vnet config file
  * See [additional docs](/flowcoll/configuration/encrypting-configuration-files/encrypting-azure-vnet-configuration.md) if you are using NetObserv Flow and want to encrypt Azure vnet config
* NetObserv SNMP: snmpcoll.yml
* NetObserv SNMP Trap: trapcoll.yml

## Set Up Encryption For Configuration Files <a href="#f4027373-4813-4604-9869-40687e34f955" id="f4027373-4813-4604-9869-40687e34f955"></a>

There are two modes of encryption:

1. (default) full-file encryption -- where the entire contents of the yml config file is encrypted.
2. Value-only encryption -- where the config names are plain-text in the yml file, but all the values are encrypted.

### Install System Dependencies <a href="#a0fc48dd-3a9c-4135-b812-f6c5fec662aa" id="a0fc48dd-3a9c-4135-b812-f6c5fec662aa"></a>

Ensure [age](https://github.com/FiloSottile/age) is installed in your local environment in order to edit the config file

```
# Debian based linux
sudo apt install age
age --version # to verify install
```

Or (for RPM based distributions)

```
# RPM based linux
sudo dnf install epel-release
sudo dnf install age
age --version # to verify install
```

If you want to use the value-only encryption mode, you must also install `sops`. Follow the [sops installation steps](https://github.com/getsops/sops?tab=readme-ov-file#1download) to install sops.

### Create Encryption Keys <a href="#c4e67db1-c40e-4f40-b62d-1d5cf5cb41bf" id="c4e67db1-c40e-4f40-b62d-1d5cf5cb41bf"></a>

<pre><code>sudo mkdir -p /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
cd /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
age-keygen | sudo tee key.age
age-keygen -y key.age | sudo tee public-age-keys.txt
</code></pre>

If you also want to encrypt the private key with a password (optional):

<pre><code>cd /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age
sudo age --encrypt -p -o key.age.enc key.age
sudo mv key.age.enc key.age
</code></pre>

### Enable File Encryption <a href="#id-0222e94b-dc82-41e7-b8ad-c2687cc5188e" id="id-0222e94b-dc82-41e7-b8ad-c2687cc5188e"></a>

Edit the file /etc/systemd/system/<code class="expression">page.vars.product\_shortname</code>.env

* set `EF_CONFIG_ENCRYPT_ENABLE=true`
* if you used a password to encrypt the private key, set `EF_CONFIG_ENCRYPT_PASSWORD` to match the password

If you want to use the alternative mode of encryption (where only values are encrypted), then change `EF_CONFIG_ENCRYPT_TYPE` to be `sops`

Then reload system config: `sudo systemctl daemon-reload`

#### Setting Up Initial Encryption <a href="#ab003428-1870-4c32-a69d-1ebe184b631a" id="ab003428-1870-4c32-a69d-1ebe184b631a"></a>

You must manually encrypt the config file for the first time.

**For Default Encryption Mode**

<pre><code>cd /etc/elastiflow
sudo age -e -R ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt -o <code class="expression">page.vars.product_shortname</code>.enc.yml <code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.enc.yml <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

**For Value-Only Encryption Mode**

If you have set `EF_CONFIG_ENCRYPT_TYPE` to `sops`, then you have to do the initial encryption of <code class="expression">page.vars.product\_shortname</code>.yml

<pre><code>cd /etc/elastiflow
sudo sops encrypt --age $(&#x3C; ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) --input-type yaml --output-type yaml --output "<code class="expression">page.vars.product_shortname</code>.yml.enc" <code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.yml.enc <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

### Restart NetObserv <a href="#id-717c1466-f455-4b3a-91a6-83fa1809dca7" id="id-717c1466-f455-4b3a-91a6-83fa1809dca7"></a>

Restart NetObserv, and it will use the encrypted config file

<pre><code>sudo systemctl daemon-reload
sudo systemctl restart <code class="expression">page.vars.product_shortname</code>
</code></pre>

## Editing Config Files <a href="#id-2328ded6-1033-4ef2-9c46-1d65057414b7" id="id-2328ded6-1033-4ef2-9c46-1d65057414b7"></a>

#### Using Default Encryption Mode <a href="#id-0edea2d1-b89a-4283-b599-8220fcc9bad7" id="id-0edea2d1-b89a-4283-b599-8220fcc9bad7"></a>

To edit an encrypted config file, you will need to use the `age` cli tool to decrypt first.

<pre><code>cd /etc/elastiflow
sudo age -d -o <code class="expression">page.vars.product_shortname</code>.decrypted.yml -i ./<code class="expression">page.vars.product_shortname</code>/.age/key.age ./<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

Then edit the contents of <code class="expression">page.vars.product\_shortname</code>.decrypted.yml

Once done, use `age` to encrypt again

<pre><code>cd /etc/elastiflow
sudo age -e -R ./<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt -o <code class="expression">page.vars.product_shortname</code>.yml <code class="expression">page.vars.product_shortname</code>.decrypted.yml
sudo rm <code class="expression">page.vars.product_shortname</code>.decrypted.yml
</code></pre>

Then restart NetObserv

#### Using Value-Only Encryption Mode <a href="#id-39297bb7-ef3d-4de5-b73c-4c6f07a595e2" id="id-39297bb7-ef3d-4de5-b73c-4c6f07a595e2"></a>

To securely edit encrypted configuration files, you can use sops via the CLI:

<pre><code>SOPS_AGE_RECIPIENTS=$(&#x3C;/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) \
SOPS_AGE_KEY_FILE=/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age \
sudo --preserve-env=SOPS_AGE_RECIPIENTS --preserve-env=SOPS_AGE_KEY_FILE \
sops /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

This command will decrypt the file in memory and open with a cli text editor. By default, the editor used will be vim

To use another editor (like nano) instead of vim, change the `EDITOR` environment variable:

<pre><code>EDITOR=nano \
SOPS_AGE_RECIPIENTS=$(&#x3C;/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/public-age-keys.txt) \
SOPS_AGE_KEY_FILE=/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age \
sudo --preserve-env=SOPS_AGE_RECIPIENTS --preserve-env=SOPS_AGE_KEY_FILE --preserve-env=EDITOR \
sops /etc/elastiflow/<code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

Then restart NetObserv

### Disabling File Encryption <a href="#fee26357-e94f-423c-8088-2b3fa32a6dea" id="fee26357-e94f-423c-8088-2b3fa32a6dea"></a>

Edit /etc/systemd/system/<code class="expression">page.vars.product\_shortname</code>.env and set `EF_CONFIG_ENCRYPT_ENABLE=false`

If using default encryption mode, use this command to decrypt config file:

<pre><code>cd /etc/elastiflow
sudo age -d -o <code class="expression">page.vars.product_shortname</code>.decrypted.yml -i ./<code class="expression">page.vars.product_shortname</code>/.age/key.age ./<code class="expression">page.vars.product_shortname</code>.yml
sudo mv <code class="expression">page.vars.product_shortname</code>.decrypted.yml <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>

If using value-only encryption mode, use this command:

<pre><code>cd /etc/elastiflow
SOPS_AGE_KEY_FILE="/etc/elastiflow/<code class="expression">page.vars.product_shortname</code>/.age/key.age" sudo --preserve-env=SOPS_AGE_KEY_FILE sudo --preserve-env=SOPS_AGE_KEY_FILE sops decrypt --input-type yaml --output-type yaml --output "<code class="expression">page.vars.product_shortname</code>.yml.dec" "<code class="expression">page.vars.product_shortname</code>.yml"
sudo mv <code class="expression">page.vars.product_shortname</code>.yml.dec <code class="expression">page.vars.product_shortname</code>.yml
</code></pre>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/trapcoll/configuration/encrypting-configuration-files.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.