---
name: "msencrypt"
section: "1"
platform: "linux"
package: "mapserver-bin"
version: "8.4.0-4+deb13u2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/msencrypt"
---

# msencrypt(1)

create an encryption key or encrypt portions of connection strings for use in mapfiles

## NAME

msencrypt - create an encryption key or encrypt portions of connection strings for use in mapfiles

## SYNOPSIS

FC**msencrypt**F\[0\]  \[FC**-keygen**F\[0\] *file* \| FC**-key**F\[0\] *file* *string*\]

## DESCRIPTION

**msencrypt** can create an encryption key or encrypt portions of connection strings for use in mapfiles. Typically you might want to encrypt portions of the CONNECTION parameter for a database connection. The following CONNECTIONTYPEs are supported for using this encryption method:

- •

  OGR

- •

  Oracle Spatial

- •

  PostGIS

- •

  SDE

## OPTIONS

- FC**-keygen**F\[0\] *file*

  Creates a new encryption key in *file*.

- FC**-key**F\[0\] *file* *string*

  Use the key in *file* to encrypt *string*.

## NOTES

**Use in Mapfile**.

The location of the encryption key can be specified by two mechanisms, either by setting the environment variable MS\_ENCRYPTION\_KEY or using a CONFIG directive in the MAP object of your mapfile. For example:

```
FC
        CONFIG MS_ENCRYPTION_KEY "/path/to/mykey.txt"
      F[0]
```

Use the { and } characters as delimiters for encrypted strings inside database CONNECTIONs in your mapfile. For example:

```
FC
        CONNECTIONTYPE ORACLESPATIAL
        CONNECTION "user/{MIIBugIBAAKBgQCP0Yj+Seh8==}@service"
      F[0]
```

## EXAMPLE

```
FC
        LAYER
          NAME "provinces"
          TYPE POLYGON
          CONNECTIONTYPE POSTGIS
          CONNECTION "host=127.0.0.1 dbname=gmap user=postgres password=iluvyou18 port=5432"
          DATA "the_geom FROM province using SRID=42304"
          STATUS DEFAULT
          CLASS
            NAME "Countries"
            COLOR 255 0 0
          END
        END
      F[0]
```

Here are the steps to encrypt the password in the above connection:

- 1\.

  Generate an encryption key (note that this key should not be stored anywhere within your web server's accessible directories):

```
FC
        msencrypt -keygen "/home/user/mykey.txt"
        F[0]
```

And this generated key file might contain something like:

```
FC
        2137FEFDB5611448738D9FBB1DC59055
        F[0]
```

- 2\.

  Encrypt the connection's password using that generated key:

```
FC
        msencrypt -key "/home/user/mykey.txt" "iluvyou18"
        F[0]
```

Which returns the password encrypted, at the commandline (you'll use it in a second):

```
FC
        3656026A23DBAFC04C402EDFAB7CE714
        F[0]
```

- 3\.

  Edit the mapfile to make sure the 'mykey.txt' can be found, using the "MS\_ENCRYPTION\_KEY" environment variable. The CONFIG parameter inside the MAP object can be used to set an environment variable inside a mapfile:

```
FC
        MAP
            ...
            CONFIG "MS_ENCRYPTION_KEY" "/home/user/mykey.txt"
            ...
        END #mapfile
        F[0]
```

- 4\.

  Modify the layer's CONNECTION to use the generated password key, making sure to use the "{}" brackets around the key:

```
FC
        CONNECTION "host=127.0.0.1 dbname=gmap user=postgres
                    password={3656026A23DBAFC04C402EDFAB7CE714} port=5432"
        F[0]
```

- 5\.

  Done! Give your new encrypted mapfile a try with the [**map2img**(1)](/map2img/1.md) utility!