AutoUpgrade Keystore Security Changes in 26.6

Uncategorized 1 Minute

In the latest version of AutoUpgrade (26.6), you will notice some changes to the AutoUpgrade keystore.

AutoUpgrade uses a keystore to store sensitive information like your MOS credentials, TDE keystore passwords and authorization tokens.

We’ve implemented these changes to better protect your data.

Password Length

Your AutoUpgrade keystore password should contain:

  • At least 16 characters
  • Alphabetic characters
  • At least one number or special character

If your password is 7 characters or fewer, AutoUpgrade throws an error:

Starting AutoUpgrade Patching Password Loader - Type help for available options
Creating new AutoUpgrade Patching keystore - Password required
Enter password:
PKI-01002: Invalid password. Passwords must have a minimum length of sixteen characters and contain alphabetic characters combined with numbers or special characters.

If your password is 8-15 characters long, AutoUpgrade prints a warning but allows you to use the weak password:

Starting AutoUpgrade Patching Password Loader - Type help for available options
Creating new AutoUpgrade Patching keystore - Password required
Enter password:
Warning: For security reasons, passwords must have at least 16 characters.
Enter password again:

The warning message is misleading. It states that you must use a stronger password. The correct word would be should.

Keep your secrets safe; use a strong password!

Keystore Permissions

Only the current user can have write access to the keystore folder and the files inside it.

If your file permissions are too permissive, you’ll see an error message:

Unable to connect to the Oracle Update Advisor service using the provided credentials
*No messages received from the Oracle Update Advisor service*

Or:

Oracle Update Advisor service - Connection Failure
*Tag mismatch!*

AutoUpgrade requires that you use strict file permissions:

find <keystore-folder> -type d -exec chmod 700 {} +
find <keystore-folder> -type f -exec chmod 600 {} +

That’s It

To keep your credentials and other sensitive information safe, AutoUpgrade now enforces stronger security practices.

At first glance, this might be an annoyance, but with AI changing how we work, protecting credentials and other secrets is more important than ever.

Happy safekeeping!

Published

Leave a comment