This can cause issues when trying to comply with policies around protecting Personally Identifiable Information , making systems Payment Card Industry Data Security Standard (PCI DSS) compliant or when implementing S/Ox controls.
We assume that you are running RabbitMQ under the local system account. Users who run RabbitMQ under different accounts or in different locations must change certain commands or settings. The RabbitMQ team has a good set of documentation on their web site.
- Windows installation instructions: https://www.rabbitmq.com/install-windows.html
- Windows quirks: https://www.rabbitmq.com/windows-quirks.html
- Database and configuration file locations: https://www.rabbitmq.com/relocate.html
- The service installer provisions RabbitMQ to runs as "Local System" when installed with rabbitmq-service.bat https://www.rabbitmq.com/man/rabbitmq-service.man.html
We'll use Encrypted File System (EFS), available with Microsoft operating systems, to encrypt the directories and files that contain the disk based information. EFS directories will be come unreadable by anyone other than the Local Service account. This means you have to decide if you want to encrypt data directories, configuration directors or just individual files as they will be come unusable by anyone other than the service account.
Portions of this document are based on the following web postings.
- Stop RabbitMQ
- Download PsExec which is part of the awesome Sysinternals suite. It is essentially a Windows version of remote commands and sudo.
- Run the psexec command to encrypt the directory acting as the Local System account.
- Restart RabbitMQ
- Download PsExec and unpack the zip file. The files can be run from the un-zipped archive without installation. Remember the path you put them on. I unzipped PSTools into \tools.
- Open an administrative command prompt.
- Stop the RabbitMQ service using the the services control panel. Find services via windows search or run services.msc from an administrative command prompt.
- Used Psexec to open a command prompt that is owned by the Local System account
- <app-path>\psexec -sid cmd.exe
- Verify this command worked by typing whoami in the new command prompt window. It should say "nt authority\system"
- The default location is the AppData directory of the user id that installed RabbitMQ.
- On my machine it was in C:\Users\<userid>\AppData\Roaming\RabbitMQ\db\<clusternode>-mnesia
- cipher /e /s:rabbit@<machinename>-mnesia
- Ex: cipher /e /s:rabbit@WIN8-MACBOOK-15-mnesia
- You should see messages listing the files and directories that are encrypted
- The directory will show in green in the file explorer on windows 8
Move the rabbitmq data directory outside of the installer's AppData\Roaming\RabbitMQ folder.
- Open a rabbitmq command prompt
- rabbitmq-service.bat remove
- set RABBITMQ_BASE=<some_folder>
- rabbitmq-service.bat install
- rabbitmq-service.bat start
Reversing the process
You can revert to an un-encrypted mnesia database by using the cipher command with /d in place of /e.
My simple test showed no measurable performance difference when posting persistent messages to a local RabbitMQ server. My test program publishes
- 6800-6900 persistent 1500 byte messages per second with EFS enabled
- 6800-6900 persistent 1500 byte messages per second with EFS disabled
I was unable to meaningfully measure the the true CPU impact of this change.
EFS is very easy to use in a situation where you don't expect to move files across systems outside of the applications using the data. Backups and other system recovery tools may be rendered useless.
The cipher command is run as the local system account. This means the directory is encrypted and owned by that account irrespective of whose AppData directory the database is actually installed in. I recommend moving your rabbit configuration , log files and mnesia database to some other location out side of some user account home directory.
Encryption certificates and recover keys may need to be retained or managed to facilitate data recovery or migration. Microsoft documents some of the key management issues in a TechNet article. The cipher command can be used to manage certificates and recovery keys.
Recommendations added 8/26/2015