Koha Encryption Key Setup Guide

Koha: Encryption Key Setup and Management

This guide walks you through configuring and securing the <encryption_key> used in Koha’s koha-conf.xml file.

Step 1: Locate the Configuration File

Open the configuration file using a terminal:

sudo nano /etc/koha/sites/[your_instance]/koha-conf.xml

Replace [your_instance] with your actual Koha site name (e.g., library).

Step 2: Check or Add the Encryption Key

Look for this section inside the file:

<!-- Encryption key for crypted password or sensitive data -->
<encryption_key>TN58bw9750</encryption_key>

Step 3: Generate a Secure Key

Generate a random 32-character Base64 key:

openssl rand -base64 32

Use the generated string to replace the existing key in the XML file.

Step 4: Set Secure Permissions

sudo chmod 640 /etc/koha/sites/library/koha-conf.xml
sudo chown koha-koha:koha-koha /etc/koha/sites/library/koha-conf.xml

Step 5: Restart Koha Services

sudo systemctl restart koha-common

Warning: If you change the encryption key on an existing system, previously encrypted data (like SIP passwords) may become unreadable. Only change the key if you're setting up a new system or know how to re-encrypt existing data.

Best Practice: Backup the koha-conf.xml file and keep the encryption key secure. Never share this key publicly.