Foglight 6.3.0 - Security and Compliance Guide

Credentials for Foglight users

When an internal Foglight® user account is created, the user's password is hashed with the MD5 algorithm and the resulting digest is stored in the Foglight database. User passwords are therefore not stored anywhere, in encrypted or in clear text form.

LDAP credentials

LDAP server passwords are encrypted with AES 256-bit. A default 256-bit AES encryption key is used in all cases of installations of Foglight®. This encryption key is stored in a Java keystore protected by a Foglight master password. Customers have the ability to change the encryption key after installation by using Foglight to generate a new key. Quest recommends customers change the default Java keystore password upon the installation of the Management Server.

NOTE: Changing the default key requires the LDAP password to be re-entered so it can be encrypted under the new key (after a password change, the Management Server can no longer decrypt existing cipher texts under the old key).

Management Server repository database credentials

The login credentials for the database administrator account on the Foglight® repository are encrypted in identical fashion as the LDAP credentials, using the same encryption key.

Foglight agent credentials

Foglight® cartridges include agents that require access to service account login credentials on the systems or applications that they monitor. Foglight stores these credentials in the repository database which is protected by access control. Any agent property that is marked as sensitive is masked during display in user interface consoles.

All agent properties are stored encrypted in an XML configuration file on the monitored host.