vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Divide the string that you want to encrypt in parts that are a maximum of 245 bytes.
2. Encrypt the parts from step 1 and make sure the are base64 encoded.
3. Concatenate the encode parts from step 2 with the colon ":" character.
4. Use the value from step 3 in the encrypted field.



Example of a JDBCurl:

{"enc}f1JwT6s3TT5ml+Ir7Y1ndRA8J4zq/KMVlgYGP44k9DxOiSiLEJ82giOvP86lHIDgiOM6zmZ5rN6j6/pRdlFnA/f5UiKj0gDx2LKViyEXyMyptQwDOfs8Lk2qPjM0G8M1WiPHvOVT6iYezgOv04DhNclIVwxAncPBvrUfMi3N5ZgyBrN5gyg/h/bCLQvIBkrcIaSnUHK2Uij6nDfcsPROHjpjI5KX24sHUFbNMkGPfyDsxHUw5ukFxyY3rV4MSHgBsDlq03qKTpnaFCUKAdybpolxA64i8cI0DW1stMpTa5QbuRodnZxa/9cj0QMokzmCNFnvyrHro8gI2TPCAkJLZw==:f1JwT6s3TT5ml+Ir7Y1ndRA8J4zq/KMVlgYGP44k9DxOiSiLEJ82giOvP86lHIDgiOM6zmZ5rN6j6/pRdlFnA/f5UiKj0gDx2LKViyEXyMyptQwDOfs8Lk2qPjM0G8M1WiPHvOVT6iYezgOv04DhNclIVwxAncPBvrUfMi3N5ZgyBrN5gyg/h/bCLQvIBkrcIaSnUHK2Uij6nDfcsPROHjpjI5KX24sHUFbNMkGPfyDsxHUw5ukFxyY3rV4MSHgBsDlq03qKTpnaFCUKAdybpolxA64i8cI0DW1stMpTa5QbuRodnZxa/9cj0QMokzmCNFnvyrHro8gI2TPCAkJLZw=="

Note: This key is only valid during the session.

Use the prefix {enc} on encrypted field values. For example: "password" : "{enc}encryptedpassword". Encrypted values are Base64 encoded.

Note: When starting a new session, you must re-encrypt sensitive information that is contained in modules.
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a data encryption key (DEK), wrapped with the root key
$ ibmcloud kp key wrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea

Wrapping key...
OK
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 capture the ciphertext
$ CIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 unwrap the ciphertext to reveal the plaintext data encryption key (DEK)
$ ibmcloud kp key unwrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea $CIPHERTEXT

Unwrapping key...
OK
Plaintext Rewrapped Plaintext
mXW4GmBhkRG1+Dzkx1D6dMX99a4KyYwtwbghaaLEQZ0=





 Example 2 

Unwrap a ciphertext and provide AAD information.

One use case for supplying additional authentication data (AAD) is to "password protect" the ciphertext to make it more difficult to unwrap.

The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext data encryption key (DEK).

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

5f2cc155-fe16-492c-845c-4d1f0688c7ba
Valid values are 'aes-256-cbc', 'aes-192-cbc', 'aes-128-cbc', 'aes-256-gcm', 'aes-128-gcm', '3des-cbc'. When using 'aes-128-gcm' or 'aes-256-gcm' authentication should be set to 'none'.
* --dhgroup value: DH group number of the IKE policy. Valid values are '2', '14', '19', '20', '24', '5', '1'.
* --presharedkey value: Preshared key used in this VPN connection. The key length must be even.
* --key-lifetime value: Key lifetime of the IKE policy in seconds. Valid range is 180 to 86400 seconds.
* --json: Format output in JSON



--------------------







 ibmcloud pi vpn-ike-policy-update 



 Update a VPN IKE policy 

ibmcloud pi vpn-ike-policy-update IKE_POLICY_ID [--name NEW_NAME] [--version VERSION] [--authentication AUTHENTICATION] [--encryption ENCRYPTION] [--dh-group DH_GROUP] [--preshared-key KEY] [--key-lifetime SECONDS] [--json]



* IKE_POLICY_ID: The unique identifier of the VPN IKE policy



Options



* --name value: New unique name of the IKE Policy. The maximum name length is 47 characters.
* --version value: Version number of the IKE Policy. Valid values are '2', '1'.
* --authentication value: Authentication algorithm of the IKE Policy. Valid values are 'sha-256', 'sha-384', 'sha1', 'none'.
* --encryption value: Encryption algorithm of the IKE Policy.
mXW4GmBhkRG1+Dzkx1D6dMX99a4KyYwtwbghaaLEQZ0=





 Example 2 

Generate a base64-encoded data encryption key (DEK) and wrap it with the root key.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

9052d914-bebe-4177-90e9-6073a167b507

 create a random, base64-encoded, 32-byte data encryption key (DEK)
$ PLAINTEXT=$(openssl rand -base64 32)

$ echo $PLAINTEXT

tEqoiCu9CeUsbqRe6yBUkrJg80QKKG/z46OkX0YQMV8=

 wrap the plaintext key with the root key, creating a DEK (this is the ciphertext)
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -p $PLAINTEXT --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT

eyJjaXBoZXJ0ZXh0IjoiTkdQRlhCb1dT ...<redacted>... M2ExNjdiNTA3In0=

 unwrap the ciphertext and reveal the original DEK
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT

tEqoiCu9CeUsbqRe6yBUkrJg80QKKG/z46OkX0YQMV8=





 Example 3 

Wrap a root key and provide AAD information.

One use case for supplying additional authentication data (AAD) is to "password protect" and add a "verification phrase" to the ciphertext, which makes it more difficult to unwrap.

The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext DEK.

 create a root key
Enter the code contained in your email and click Continue

Zoom

![MAS-MS-Password-Change-3](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Password-Change-3.png)

Figure 3. MAS Login Code Confirmation
4. The email with the confirmation code will look similar to below.

Zoom

![MAS-MS-Password-Change-4](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Password-Change-4.png)

Figure 4. MAS Login Code Email
5. After the emailed confirmation code is entered in the above screen, you will see following screen asking for the password. You will receive the temporary password (again via email).

Zoom

![MAS-MS-Password-Change-5](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Password-Change-5.png)

Figure 5. MAS Login Temp Password
6. The email with the temporary password will look similar to below.

Zoom

![MAS-MS-Password-Change-6](https://cloud.ibm.com/docs-content/v1/content/ce5408d6eecb7244ea40dac01f6d3acf7ff60148/mas-saas/images/MAS-MS-Password-Change-6.png)

Figure 6. MAS Login Temp Password email
7.
3. Click the instance name of the backup vault where you want to change your password.
4. On the Overview page, you can see your Portal Password. Click the Pencil icon to modify the password.

The IBM Cloud Backup for Classic username is displayed in the upper-left area of the page.
5. Enter the new password in the Password field.

The password must be 8 - 12 characters in length. It must include at least one uppercase letter, at least one lowercase letter, at least one numeric character, and at least one of these special characters: !@#%^. It can contain only letters, numerals, and these special characters: !@#%^.
6. Press Enter to update the password.



* What kind of applications can be backed up?

IBM Cloud® Backup for Classic can be used to back up various applications. IBM Cloud® also offers software agents for some of the more common software systems that are backed up, which include the following plug-ins.



* [Bare Metal Restore](https://cloud.ibm.com/docs/Backup?topic=Backup-BMRplugin)
* [Microsoft® Exchange](https://cloud.ibm.com/docs/Backup?topic=Backup-Exchangeplugin)
* [Microsoft® SQL](https://cloud.ibm.com/docs/Backup?topic=Backup-MSSQLpluginMSSQLplugin)
* [Oracle](https://cloud.ibm.com/docs/Backup?topic=Backup-OraclepluginOracleplugin)
* [VMware® VRA](https://cloud.ibm.com/docs/Backup?topic=Backup-VRAVRA)



The plug-ins that are listed here are only compatible with Windows® servers, except for the Oracle or VMware® plug-ins. Each agent is available as an add-on to your backup service at no cost.
* How frequently can we back up the data?

Within Cloud Backup Portal, backups can be made manually, or can be scheduled as a single instance, or to be recurring.
In the IBM Cloud, an administrator, or a user that has the correct access in your account, has different options to manage a user's login settings. For example, an administrator can order external authentication options, enable a one-time passcode to be used during login, enable the use of security questions at login, or set a password expiration time period. For more information, see [Types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types).



* A user can log in by using a user ID and password.
* A federated user that uses a corporate or enterprise single sign-on ID can log in to IBM Cloud from the command-line interface (CLI) by using either a one-time passcode or an API key. For more information, see [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id).
* A user can log in by using an API key.
* A federated user that uses a corporate or enterprise single sign-on ID can log in to IBM Cloud by applying a trusted profile.



The following fields include extra information:



* The initiator.name includes information about the user that logs in to the account.
* The X-Global-Transaction-Id includes an ID that you can use when you open a support ticket if you need to get more information.





 Log in from the IBM Cloud UI 

When a user logs in from the IBM Cloud UI, you get an event in the account with action iam-identity.user-refreshtoken.login.

The following field includes extra information:



* In requestData, the client_id field is set to HOP55v1CCT. This value indicates a UI request.







 Log in with a federated ID from the IBM Cloud CLI by using a one-time passcode or an API key
IA-5 (c) <br><br> * Check whether App ID advanced password policies are enabled<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID prevent username in password policy is enabled<br> * Check whether App ID password strength regex is configured<br> * Check whether OpenShift cluster has image pull secrets enabled<br> * IBM Cloud IAM ensures that authenticators, such as API keys, have sufficient strength for their intended use<br> * Check whether VPN for VPC authentication is configured with a strong pre-shared key with at least # characters<br> * Check whether App ID avoid password reuse policy is enabled<br> * IBMid ensures that passwords have sufficient strength for their intended use<br><br><br> 
 IA-5 (f) <br><br> * Check whether App ID minimum period between password changes policy is set to greater than 0<br> * IBM Cloud IAM establishes minimum and maximum lifetime restrictions and reuse conditions for authenticators, such as API keys<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * IBMid establishes minimum and maximum lifetime restrictions and reuse conditions for authenticators<br> * Check whether App ID avoid password reuse policy is enabled<br><br><br> 
 IA-5 (g) <br><br> * Check whether Secrets Manager user credentials are rotated at least every # days<br> * Check whether Secrets Manager arbitrary secrets are rotated at least every # days<br> * Check whether Hyper Protect Crypto Services encryption keys that are generated by the service are rotated automatically at least every # months<br><br><br> 







 NIST supplemental guidance 

Individual authenticators include, for example, passwords, tokens, biometrics, PKI certificates, and key cards. Initial authenticator content is the actual content (e.g., the initial password) as opposed to requirements about authenticator content (e.g., minimum password length).
signature_threshold = 1
revocation_threshold = 1
admins {
name = "admin1"
key = "/cloudTKE/1.sigkey"
token = "sensitive1234"
}
admins {
name = "admin2"
key = "/cloudTKE/2.sigkey"
token = "sensitive1234"
}
}

resource "ibm_iam_user_policy" "policy" {
ibm_id = "user@ibm.com"
roles = ["Manager"]

resources {
service = "test-hpcs"
resource_instance_id = element(split(":", ibm_resource_instance.hpcs.id), 7)
}
}
Show more

In production environments, it is suggested to provide the passwords for the signature key files or the tokens for the signing service during the process of applying Terraform instead of writing it in plaintext in the configuration file. In that case, you are prompted to enter the authentication passwords or tokens when you run Terraform commands. After the instance initialization, the values that you enter for the passwords or tokens are stored in a .tfstate file. For more information about securing sensitive data in Terraform, see [Sensitive Data in State](https://www.terraform.io/docs/language/state/sensitive-data.html).

The following table lists supported parameters when you create and initialize a service instance with Terraform:



Table 1. Supported parameters for provisioning a service instance with Terraform

 Parameter Description 

 name Required. The name of your Hyper Protect Crypto Services instance. 
 location Required. The region abbreviation, such as us-south, that represents the geographic area where the operational crypto units of your service instance are located. For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype ([SecretActionPrototype](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-action-prototype-example-schema))
: The request body to specify the properties for your secret action. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-action-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-action-create --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-action-prototype='{"action_type": "public_cert_action_validate_dns_challenge"}'









 Secret versions 

Create and manage the versions of your secrets.



 ibmcloud secrets-manager secret-version-create 

Create a new secret version.

ibmcloud secrets-manager secret-version-create --secret-id SECRET-ID --secret-version-prototype SECRET-VERSION-PROTOTYPE



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.
Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a data encryption key (DEK), wrapped with the root key
$ ibmcloud kp key wrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea

Wrapping key...
OK
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 capture the ciphertext
$ CIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 unwrap the ciphertext to reveal the plaintext data encryption key (DEK)
$ ibmcloud kp key unwrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea $CIPHERTEXT

Unwrapping key...
OK
Plaintext Rewrapped Plaintext
mXW4GmBhkRG1+Dzkx1D6dMX99a4KyYwtwbghaaLEQZ0=





 Example 2 

Unwrap a ciphertext and provide AAD information.

One use case for supplying additional authentication data (AAD) is to "password protect" the ciphertext to make it more difficult to unwrap.

The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext data encryption key (DEK).

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.
For Microsoft Active Directory, this is typically 'sAMAccountname', 'uid' for IBM® Tivoli Directory Server, and 'cn' for OpenLDAP servers. The default is 'cn'. 
 NAMECASE Indicates whether the LDAP server stores the user name in lowercase or uppercase. 







 Setting LDAP authentication with the web console 



1. [Log in to the web console](https://cloud.ibm.com/docs/netezza?topic=netezza-getstarted-console) as an admin user.
2. Go to the Query editor.
3. Register an LDAP external authentication system. Specify the necessary parameters.

REGISTER EXTERNAL AUTHENTICATION SYSTEM 'LDAP' with base 'DC=cpsdevelopment,dc=fyre,dc=ibm,dc=com' namecase lowercase server 'windowsad-security1.fyre.ibm.com' ssl 'off' binddn 'CN=mannu,CN=Users,DC=cpsdevelopment,DC=fyre,DC=ibm,DC=com' bindpw 'Netezza@1234' attrname 'sAMAccountName';
4. Create a user or users with the external authentication method set to LDAP as desribed in [Creating users](https://cloud.ibm.com/docs/netezza?topic=netezza-users-groupscreate-users).
5. Verify whether the user was created successfully.



1. Go to Users and groups > Users.
2. Locate the user.
3. Check the Authentication type section for the user.









 Setting LDAP authentication with the command-line 



1. [Connect to Netezza Performance Server](https://cloud.ibm.com/docs/netezza?topic=netezza-connecting-overview) as an admin user.

In the example, the ['nzsql' command](https://www.ibm.com/docs/en/netezza?topic=anpssbun-log-2) is used.
signature_threshold = 1
revocation_threshold = 1
admins {
name = "admin1"
key = "/cloudTKE/1.sigkey"
token = "sensitive1234"
}
admins {
name = "admin2"
key = "/cloudTKE/2.sigkey"
token = "sensitive1234"
}
}

resource "ibm_iam_user_policy" "policy" {
ibm_id = "user@ibm.com"
roles = ["Manager"]

resources {
service = "test-hpcs"
resource_instance_id = element(split(":", ibm_resource_instance.hpcs.id), 7)
}
}
Show more

In production environments, it is suggested to provide the passwords for the signature key files or the tokens for the signing service during the process of applying Terraform instead of writing it in plain text in the configuration file. In that case, you are prompted to enter the authentication passwords or tokens when you run Terraform commands. After the instance initialization, the values that you enter for the passwords or tokens are stored in a .tfstate file. For more information about securing sensitive data in Terraform, see [Sensitive Data in State](https://www.terraform.io/docs/language/state/sensitive-data.html).

The following table lists supported parameters when you create and initialize a service instance with Terraform:



Table 1. Supported parameters for provisioning a service instance with Terraform

 Parameter Description 

 name Required. The name of your Hyper Protect Crypto Services instance. 
 location Required. The region abbreviation, such as us-south, that represents the geographic area where the operational crypto units of your service instance are located. For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype ([SecretActionPrototype](https://cloud.ibm.com/docs/cli?topic=cli-secrets-manager-clicli-secret-action-prototype-example-schema))
: The request body to specify the properties for your secret action. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-action-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-action-create --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-action-prototype='{"action_type": "public_cert_action_validate_dns_challenge"}'









 Secret versions 

Create and manage the versions of your secrets.



 ibmcloud secrets-manager secret-version-create 

Create a new secret version.

ibmcloud secrets-manager secret-version-create --secret-id SECRET-ID --secret-version-prototype SECRET-VERSION-PROTOTYPE



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.
LDAP binding username
: The username used to bind to the directory service. In most cases, this username is a distinguished name (DN). The logon name might sometimes work with Active Directory. But unlike the general Windows logon, it is case sensitive. The distinguished name always works.

LDAP binding user password
: The password used to bind to the directory service.

LDAP base DN
: The starting point for searching user entries in LDAP, for example CN=Users,DC=example,DC=com.

LDAP user filter
: The user filter to search user entries in LDAP. If unspecified, the default value is (userPrincipalName={0}).



If you are using version 2.2.1 or earlier, then you must complete some extra prerequisite tasks before you can connect to the data source. For more information, see [SharePoint On Prem prerequisite steps for prior releases](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-onprem-cp4dprior-prereqs).





 Connecting to a SharePoint On Prem data source 

From your Discovery project, complete the following steps:



1. From the navigation pane, choose Manage collections.
2. Click New collection.
3. Click SharePoint On Prem, and then click Next.
4. Name the collection.
5. If the language of the documents in SharePoint is not English, select the appropriate language.

For a list of supported languages, see [Language support](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-language-support).
6. Optional: Change the synchronization schedule.

For more information, see [Crawl schedule options](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionscrawlschedule).
7. In the Enter your credentials section, complete the following fields:

Username
Root password expiration N/A N/A Root passwords for the worker nodes expire after 90 days for compliance reasons. If your automation tooling needs to log in to the worker node as root or relies on cron jobs that run as root, you can disable the password expiration by logging into the worker node and running chage -M -1 root. Note: If you have security compliance requirements that prevent running as root or removing password expiration, don't disable the expiration. Instead, you can [update](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_update) or [reload](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) your worker nodes at least every 90 days. 
 systemd N/A N/A Periodically clean transient mount units to prevent them from becoming unbounded. This action addresses [Kubernetes issue 57345](https://github.com/kubernetes/kubernetes/issues/57345) 







 Change log for worker node fix pack 1.8.15_1520, released 23 August 2018 



Table 1. Changes since version 1.8.15_1519

 Component Previous Current Description 

 systemd 229 230 Updated systemd to fix cgroup leak. 
 Kernel 4.4.0-127 4.4.0-133 Updated worker node images with kernel update for [CVE-2018-3620,CVE-2018-3646](https://ubuntu.com/security/notices/USN-3741-1) 







 Change log for worker node fix pack 1.8.15_1519, released 13 August 2018 



Table 1. Changes since version 1.8.15_1518

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 







 Change log for 1.8.15_1518, released 27 July 2018 



Table 1. Changes since version 1.8.13_1516

 Component Previous Current Description