NAME

       bcfg2-crypt - Bcfg2 encryption and decryption utility

SYNOPSIS

       bcfg2-crypt   [-C   configfile]   [--decrypt|--encrypt]   [--cfg|--properties]  [--stdout]
       [--remove] [--xpath xpath] [-p passphrase-or-name] [-v] [-I] filename [filename...]

DESCRIPTION

       bcfg2-crypt performs encryption and decryption of Cfg and  Properties  files.  It's  often
       sufficient  to  run  bcfg2-crypt  with  only  the  name of the file you wish to encrypt or
       decrypt; it can usually figure out what to do.

OPTIONS

       -C configfile
              Specify alternate bcfg2.conf location.

       --decrypt, --encrypt
              Select encryption or decryption  mode  for  the  given  file(s).  This  is  usually
              unnecessary,  as  bcfg2-crypt  can  often determine which is necessary based on the
              contents of each file.

       --cfg  An XML file should be encrypted in its  entirety  rather  than  element-by-element.
              This  is  only  necessary  if the file is an XML file whose name ends with .xml and
              whose top-level tag is <Properties>. See [MODES] below for details.

       --properties
              Process a file as an XML Properties file, and encrypt  the  text  of  each  element
              separately.  This  is  necessary if, for example, you've used a different top-level
              tag than Properties in your Properties files. See [MODES] below for details.

       --stdout
              Print the resulting file to stdout instead of writing it to a file.

       --remove
              Remove the plaintext file after it has been encrypted.   Only  meaningful  for  Cfg
              files.

       --xpath xpath
              Encrypt  the  character  content  of  all  elements  that match the specified XPath
              expression.  The default is *[@encrypted] or *; see [MODES] below for more details.
              Only meaningful for Properties files.

       -p passphrase
              Specify  the  name  of  a  passphrase  specified  in  the  [encryption]  section of
              bcfg2.conf. See [SELECTING PASSPHRASE] below for more details.

       -v     Be verbose.

       -I     When encrypting a Properties file, interactively select  the  elements  whose  data
              should be encrypted.

       -h     Print usage information.

MODES

       bcfg2-crypt can encrypt Cfg files or Properties files; they are handled very differently.

       Cfg    When  bcfg2-crypt  is used on a Cfg file, the entire file is encrypted. This is the
              default behavior on files that are not XML, or that are XML but whose top-level tag
              is not <Properties>.  This can be enforced by use of the --cfg option.

       Properties
              When bcfg2-crypt is used on a Properties file, it encrypts the character content of
              elements matching the XPath expression given by --xpath. By default the  expression
              is  *[@encrypted],  which  matches all elements with an encrypted attribute. If you
              are encrypting a file and that expression doesn't  match  any  elements,  then  the
              default  is  *,  which  matches everything. When bcfg2-crypt encrypts the character
              content of an element, it also adds the encrypted attribute, set to the name of the
              passphrase  used  to  encrypt that element. When it decrypts an element it does not
              remove encrypted, though; this lets you  easily  and  efficiently  run  bcfg2-crypt
              against  a  single  Properties  file  to  encrypt and decrypt it without needing to
              specify a long list of options. See the online Bcfg2 docs on Properties  files  for
              more information on how this works.

SELECTING PASSPHRASE

       The passphrase used to encrypt or decrypt a file is discovered in the following order.

       1. The passphrase given on the command line using -p is used.

       2. If exactly one passphrase is specified in bcfg2.conf, it will be used.

       3. If  operating  in  Properties  mode,  bcfg2.conf  will  attempt to read the name of the
          passphrase from the encrypted elements.

       4. If decrypting, all passphrases will be tried sequentially.

       5. If no passphrase has been determined at this point, an error is produced and  the  file
          being encrypted or decrypted is skipped.

SEE ALSO

       bcfg2-server(8)