Hi David, On Fri, Jan 6, 2023 at 5:58 PM David Liddle <david.liddle@wycliff.de> wrote:
<!-- This is the bcrypt settings used to generated anonymized content --> <bcrypt_settings>__BCRYPT_SETTINGS__</bcrypt_settings>
What form should the content of this line and these settings take?
As mentioned in one of the comments in bug 28911, an appropriate value can be generated by the following command: htpasswd -bnBC 10 "" password | tr -d ':\n' | sed 's/$2y/$2a/'
Similarly, I would like to know what form the encryption key should take in this section:
<!-- Encryption key for crypted password or sensitive data --> <encryption_key>__ENCRYPTION_KEY__</encryption_key>
I believe this can be set to any high-entropy string suitable for a password or pass phrase. Per the Crypt::CBC documentation < https://metacpan.org/pod/Crypt::CBC>, it's not literally an AES encryption key but is used to create one.
Are there any risks or drawbacks to enabling these settings on a live site? (I'm executing them first on a QA server with a robust backup system, but it helps to know what to expect.)
It should be pretty safe. The pseudonymization feature is turned on via a system preference and largely affects reporting, although some care would be needed as you prune non-pseudonymized data. The encryption is currently only used by the optional 2FA feature. Regards, Galen -- Galen Charlton Implementation and IT Manager Equinox Open Library Initiative gmc@equinoxOLI.org https://www.equinoxOLI.org phone: 877-OPEN-ILS (673-6457) direct: 770-709-5581