LEXolution.KMS Installation Guide - Encrypting Configuration Files

General Description

To enhance the security mechanisms of LEXolution and the STP infrastructure, starting from LEXolution version 9.4, relevant entries in the configuration files can be encrypted.

This means it is no longer possible to read credentials directly from the configuration files.

Encrypting the relevant entries is optional. A tool is provided for this purpose, which allows entries to be encrypted and decrypted.

Tool STP.Kms.ConfigEncryptor.exe

The tool is located in the delivery files in the ZipFiles directory and is named STP.Kms.ConfigEncryptor.exe as indicated above.

Prerequisites for running the tool:

• The STP.Kms.ConfigEncryptor.exe must be copied to the directory containing the configuration file to be encrypted and the executable.
• It explicitly requires administrator privileges.
• It needs access to all DLLs referenced in the configuration file.
  For example, the STP.Kms.Server.exe.config references the STP.Kms.Server.Config.Implementation.dll:

🛈 Note

To edit configuration values, you must first decrypt the configuration file if it has been encrypted.

After using the tool and completing all configuration work, the tool must be removed.

Behavior During Initial Installation and Updates

During an initial installation, configuration files are not encrypted by default. Encryption, if desired, must be applied after installation using the tool.

During an update, the application can read and write both encrypted and unencrypted configuration files. The Encryptor is not required for this.

🛈 Note

Configuration Files That Can Be Encrypted and Decrypted

How the De-/Encryptor Tool Works

• First, copy the De-/Encryptor tool to the appropriate program directory where the configuration files are to be encrypted or decrypted.
• Launch the tool using the Run as Administrator option.
• Select the relevant configuration file you want to encrypt or decrypt, then click Encrypt or Decrypt accordingly.
• The actions and results will be displayed in the gray-shaded area.

🛈 Note

The application automatically detects whether a configuration file has already been encrypted or decrypted and displays this information accordingly.