The JBossESB 4.7 Services Guide has instructions for creating an encrypted password file:

Go to the conf directory of your jboss server instance (eg: default/conf)
java -cp ../lib/jbosssx.jar org.jboss.security.plugins.FilePassword welcometojboss 13 testpass esb.password

These instructions worked just fine creating the encrypted password file I specified.  Subsequent instructions:

Configuration is done by simply substituting the clear text password in your
configuration file(s) with the path to the encrypted password file.

haven't worked for me, however, as I get Invalid user/password JMSSecurityExceptions for all of the paths I've tried thus far. Here's an excerpt from my jboss-esb.xml file (in esbcontent\META-INF) with one of my path attempts (I'd copied the esboaq.password file to the esbcontent directory):

          <jms-provider name="JBossMQ" connection-factory="ConnectionFactory">
                <property name="java.naming.factory.initial"    value="org.jboss.soa.esb.oracle.aq.AQInitialContextFactory"/>
                <property name="java.naming.oracle.aq.user"     value="user"/>
                <property name="java.naming.oracle.aq.password" value="../esboaq.password"/>
                <property name="java.naming.oracle.aq.server"   value="server"/>
                <property name="java.naming.oracle.aq.instance" value="instance"/>
                <property name="java.naming.oracle.aq.schema"   value="schema"/>
                <property name="java.naming.oracle.aq.port"     value="port"/>
                <property name="java.naming.oracle.aq.driver"   value="thin"/>   
              <jms-bus busid="quickstartGwChannel">
                  <jms-message-filter
                      dest-type="QUEUE"
                      dest-name="ACTION_REQUEST"
                      persistent="true"
                  />
              </jms-bus>
              <jms-bus busid="quickstartEsbChannel">
                  <jms-message-filter
                      dest-type="QUEUE"
                      dest-name="B"
                      persistent="true"
                  />
              </jms-bus>

          </jms-provider>

Does the generated encrypted password file have to remain in the default/conf directory?  Is the path to be used in the config file (jboss-esb.xml in my case) the one taken from the config file to the default/conf directory?  Can anyone provide a working example?  Thanks for your help!