Category Archives: Hashicorp

Hashicorp Vault – Managing Tokens

https://www.vaultproject.io/docs/concepts/tokens.htmlvault client:Creating tokens (Default Lifetime 24 hours):https://www.amon.cx/blog/managing-all-secrets-with-vault/vault token-revoke <TokenID>vault token-create -policy=mypolicyvault token-create -policy=mypolicy -ttl="1h"vault token-create -policy=mypolicy -ttl="1h" -display-name=“My's Token"vault token-create -policy=mypolicy -explicit-max-ttl="1h"Requires "brew install" jq first:VAULT_TOKEN=$(vault token-create -ttl="1h" -format=json Read more [...]

Hashicorp Vault – Reading and Writing Secrets to Vault

This article will describe how to read and write secrets to vault using the vault CLI and CURL. These instructions are assuming you are on either Linux or Mac OSX. Later we will add instructions for windows. That said, most of the Vault CLI commands should work fine on windows as well.Before you can proceed, you need to be sure you have authenticated against vault. For details on that, you can check out one of our articles about configuring vault authentication. To use the CURL commands you also Read more [...]

Hashicorp Vault – Creating a new root Token

Instructions were found here: https://www.hashicorp.com/blog/vault-0-5/Generate One time Password:vault generate-root -genotpsave OTP Output, example: tXJxQcj01NoR3whDnt9OxQ==Initialize Process:vault generate-root -init -otp="<OTP Value>"Example: vault generate-root -init -otp="tXJxQcj01NoR3whDnt9OxQ=="Enter Unseal Keys:vault generate-rootEnter unseal key when prompted. Repeat with additional reseal keys as needed. Once threshold is reached, save Encoded Root Token.Example: GYox3aZVAGXZfI9Gku1ohQ==Decode Read more [...]

Hashicorp Vault – Install Client (CLI/GUI)

Hashicorp Vault has a variety of ways to access it. You can access it via a CLI client, via the rest api/CURL, and via a third party GUI client.Intalling the CLI ClientStart by downloading the appropriate client for your platform from here:https://www.vaultproject.io/downloads.htmlOSXCopy the downloaded bin file to the /usr/local/bin folder on your local machineCreate a system variable called VAULT_ADDR and set the path to the vault server.Open a terminal windowtype cd ~type vi .bash_profilePress Read more [...]

Hashicorp Vault – Configure Authentification

There are many authentication methods for vault. This article descibes how to configure LDAP authentication and Userpass AuthenticationLDAP Authentication:The following command will configure LDAP to point at a domain controller named mydomaincontroller.mydomain.com. It will then search the search base for groups to the top of mydomain.com domain:vault write auth/ldap/config url="ldap://mydomaincontroller.mydomain.com:389" userattr=sAMAccountName userdn=“dc=mydomain,dc=com" groupdn=“dc=mydomain,dc=com" Read more [...]

Hashicorp Vault – Rekey or Unseal Vault

Unseal the vaultAfter the vault service has been restarted, the password vault is in a sealed state. This means that the encryption keys are not in memory, and the encrypted database on the disk cannot be read. More on this topic can be read here: https://www.vaultproject.io/docs/concepts/seal.htmlRekey the vaultTo Start the rekey process:To unseal the vault:Open terminaltype: vault unsealenter unseal keyRepeat the above process until you have entered enough keys to unseal the vault. We require a Read more [...]