Links: HSM

Vault by HasiCorp

• Ensure vault can lock memory mlock

  $ sudo setcap CAP_IPC_LOCK=  <bin>/9s/vault

• Config

  storage "file" {
    path = "/home/xxx/vault-data"
    address = "127.0.0.1:8500"
     path    = "vault"
  }
  
  #storage "etcd" {
  #  address  = "http://localhost:2379"
  #    etcd_api = "v3"
  #    }
  
  listener "tcp" {
        address     = "127.0.0.1:8200"
          #tls_disable = 1
          ##Cert + intermediate in concat
          tls_cert_file = "/home/xxx/ssl/concat_dev.pem"
          tls_key_file = "/home/xx/ssl/dev.key"
          }
  
  #telemetry {
  #          statsite_address = "127.0.0.1:8125"
  #           disable_hostname = true
  #            }

• Got error with client no initialized

  $ vault status
  Error checking seal status: Error making API request.
  
  URL: GET https://localdomain.com:8200/v1/sys/seal-status
  Code: 400. Errors:
  
  * server is not yet initialized

• initialize with client

  $ vault operator init
  Unseal Key 1: eTa0LIlJ1fw3WIFzF4TLLrQQh5zZIQDVML5hvLh8b/0n
  Unseal Key 2: cQPwYWRJx9U6CsydgP2z7lVEkOgvSy6dYBsdSF2Cmvld
  Unseal Key 3: zYo0SyAwce+pgtiC4gXUR8mBwOxxAFgtKrpSMMdxSyZT
  Unseal Key 4: o/u+3FjpDRUV+Bz2bbJX43lo67idFy9Ly2q+aG5r659x
  Unseal Key 5: NzHAl/80p7C0WkvuAOl2G591LOqBvOxV4+Q8Kg2/0njS
  
  Initial Root Token: 41f05975-248a-784d-cb10-96ca0d7c36a7
  
  e.g. #vault init -key-shares=3 -key-threshold=2

  • now unseal doing the following 3 times with 3 of the keys

    vault unseal

• Setup systemd https://www.digitalocean.com/community/tutorials/how-to-securely-manage-secrets-with-hashicorp-vault-on-ubuntu-16-04

• save first value in default kv /secret

  $ export rt=41f05975-248a-784d-cb10-96ca0d7c36a7
  $ VAULT_TOKEN=$rt vault write secret/mykey1 value=mysecret1
  Success! Data written to: secret/mykey1

• Generate a root otp

  $ vault operator generate-root -generate-otp
  kmXqMZ/A9BqSEf8pe/PtLQ==

• enable transit encryption etc

  $ VAULT_TOKEN=$rt vault secrets enable transit
  Success! Enabled the transit secrets engine at: transit/
  
  $ VAULT_TOKEN=$rt vault write  transit/keys/my-key3 type=ecdsa-p256 
  Success! Data written to: transit/keys/my-key3

• enable the pki / ca engine

  $ VAULT_TOKEN=$rt vault secrets enable pki
  Success! Enabled the pki secrets engine at: pki/

...