General Information on the AES256 encryption

Starting with version 16.1 Empirum provides the option to use a more secure password variant for authentication between the Empirum Agent and Empirum servers or between an Empirum depot server and the master server.

This new encryption is supplied for Empirum usage only to prevent that the decryption mechanism is launched outside the Empirum code. As a result, the new encryption cannot be used in Setup.inf scripts or similar code.

The following components can use the new AES256 password encryption option:

• Advanced Agent v16.1 and higher
• Mac Agent v16.1 and higher
• EmpSync v16.1 and higher
• EmpCrypt v16.0.3 and higher (encryption only)
• Empirum Management Console (EMC) v16.1 and higher
• Empirum SDK v1.0.1 and higher
• Variable Configurations from Empirum v23.0

Please note that the Legacy Agent does not provide support for this type of encryption.

General password rules: All passwords should not exceed 40 characters in length and have to use the following characters:

a to z, A to Z, 0 to 9 and @ ! % & / ( ) = ? { [ ] } * + ~ ' # . , ; : _ - < > |
For Mac OS X Agent and Inventory the following characters are not allowed:
% , ; ' " \ / | < > [ ] = and spaces.

Best practice

Clients access the master and depot servers via the Empirum Agent, and therefore you must update the master server and the depot servers first before changing the password encryption on the clients.

The following variables are relevant for such modification:

SUBDEPOT/PASSWORD_1
SUBDEPOT/PASSWORD_2
SUBDEPOT/PASSWORD_3
SYNC/SYNC_SERVER1
SYNC/SYNC_SERVER3

If you use DHCP options, it is also possible to use the new encryption for the EmpPW option, which is relevant for the Advanced Agent. As of today, the OS Installer (EPE) does not provide support for the new variant.

The following variables cannot be modified:

SUBDEPOT/WEBSERVER_PASSWORD und SUBDEPOT/WEBSERVER_CLIENTCERTIFICATE_PASSWORD (are not rolled out on the client)

Master server modification:

Prior to any modification to the Sync variables you should update the server. Install the subdepot package 16.1. Older rsync versions cannot use the new AES256 encryption method and depot synchronization will fail due to failed authentication.

Depot server modification:

Please update the Sync variables of all related depot servers with subdepot package 16.1 prior to depot server modification. Older EmpSync and rsync versions cannot use the new AES256 encryption method and depot synchronization will fail due to failed authentication. The existing SYNC encryption can still be used with the new EmpSync versions.

Once all depots have been updated, the respective SYNC variables of the superordinate Empirum servers can be modified and the Sync templates can be reinstalled accordingly.

Software distribution (Advanced Agent):

Once the computers have been updated, please modify the SUBDEPOT/PASSWORD_x variables on the respective depot servers and update the Agent templates accordingly.