Introduction

Maven 2.1.0+ now supports server password encryption. The main use case, addressed by this solution is:

• multiple users share the same build machine (server, CI box)
• some users have the privilege to deploy Maven artifacts to repositories, some don't.
  • this applies to any server operations, requiring authorization, not only deployment
• settings.xml is shared between users

The implemented solution adds the following capabilities:

• authorized users have an additional settings-security.xml file in their ~/.m2 folder
  • this file either contains encrypted master password, used to encrypt other passwords
  • or it can contain a relocation - reference to another file, possibly on removable storage
  • this password is created first via CLI for now
• server entries in the settings.xml have passwords and/or keystore passphrases encrypted
  • for now - this is done via CLI after master password has been created and stored in appropriate location

How to create a master password

Use the following command line:

mvn --encrypt-master-password <password>

Note: Since Maven 3.2.1 the password is an optional argument. If not provided, Maven will prompt for the password. Earlier versions of Maven will not prompt for a password, so it must be typed on the command-line in plaintext. See Tips below for more information.

This command will produce an encrypted version of the password, something like

{jSMOWnoPFgsHVpMvz5VrIt5kRbzGpI8u+9EF1iFQyJQ=}

Store this password in the ~/.m2/settings-security.xml; it should look like

<settingsSecurity>
  <master>{jSMOWnoPFgsHVpMvz5VrIt5kRbzGpI8u+9EF1iFQyJQ=}</master>
</settingsSecurity>

When this is done, you can start encrypting existing server passwords.

How to encrypt server passwords

You will have to use the following command line:

mvn --encrypt-password <password>

Note:Just like --encrypt-master-password the password argument is optional since Maven 3.2.1.

This command will produce an encrypted version of it, something like

{COQLCE6DU6GtcS5P=}

Cut-n-paste it into your settings.xml file in the server section. This will look like:

<settings>
...
  <servers>
...
    <server>
      <id>my.server</id>
      <username>foo</username>
      <password>{COQLCE6DU6GtcS5P=}</password>
    </server>
...
  </servers>
...
</settings>

Please note that password can contain any information outside of the curly brackets, so that the following will still work:

<settings>
...
  <servers>
...
    <server>
      <id>my.server</id>
      <username>foo</username>
      <password>Oleg reset this password on 2009-03-11, expires on 2009-04-11 {COQLCE6DU6GtcS5P=}</password>
    </server>
...
  </servers>
...
</settings>

Then you can use, say, deploy plugin, to write to this server:

mvn deploy:deploy-file -Durl=https://maven.corp.com/repo \
                       -DrepositoryId=my.server \
                       -Dfile=your-artifact-1.0.jar \

How to keep the master password on removable drive

Create the master password exactly as described above, and store it on a removable drive, for instance on OSX, my USB drive mounts as /Volumes/mySecureUsb, so I store

<settingsSecurity>
  <master>{jSMOWnoPFgsHVpMvz5VrIt5kRbzGpI8u+9EF1iFQyJQ=}</master>
</settingsSecurity>

in the file /Volumes/mySecureUsb/secure/settings-security.xml

And then I create ~/.m2/settings-security.xml with the following content:

<settingsSecurity>
  <relocation>/Volumes/mySecureUsb/secure/settings-security.xml</relocation>
</settingsSecurity>

This assures that encryption will only work when the usb drive is mounted by OS. This addresses a use case where only certain people are authorized to deploy and are issued these devices.

Tips

jSMOWnoPFgsHVpMvz5VrIt5kRbzGpI8u+{EF1iFQyJQ=

{jSMOWnoPFgsHVpMvz5VrIt5kRbzGpI8u+\{EF1iFQyJQ=}

mvn.bat --encrypt-master-password a!$%^b

mvn.bat --encrypt-master-password "a!$%^b"