Questions: How to install Vault Server on Ubuntu 18.04 / Debian 9?, How to Install Vault Server on CentOS 7?, How to Install Hashicorp Vault on Fedora?. Hashicorp Vault is a free and open source tool designed for securely storing and accessing secrets. A secret can be a password, API key, certificate, and more. The job of Vault Server is to provide a unified interface to any stored secret while providing tight access control and recording a detailed audit log.
Vault features a web user interface which you can use to interact with Vault. From UI you can easily create, update, read and delete secrets, authenticate, unseal, and more.
Features of Vault
Below are the key features of Vault.
Secure Secret Storage: By default Vault encrypts the secrets before writing them to persistent storage.
Support for Dynamic Secrets: Vault can generate secrets on-demand and revoke them after the lease is up.
Leasing and Renewal: All secrets in Vault have a lease associated with it. The secret is automatically revoked at the end of the lease. Renewal is possible via built-in renew APIs.
Secrets Revocation: Vault can revoke not only single secrets, but a tree of secrets, for example all secrets read by a specific user, or all secrets of a particular type.
Install Vault on Ubuntu / Debian / CentOS / Fedora
Vault is written in Go and binary packages are available for major Unix and Linux distributions. The precompiled Vault binaries are available at https://releases.hashicorp.com/vault/
Paste your “Unseal Keys” one by one to Unseal vault. You can get the keys on /etc/vault/init.file.
$ cat /etc/vault/init.file
Unseal Key 1: bNxZRU3azPZtzXjeS0pfGHLoif3Scs64fFk9j/FFtUN7
Unseal Key 2: kChe6UJ5+BnkU6UjSzalvjIuh01dLX8v/OMabz+uPtly
Unseal Key 3: MIRYhY1zQXZyod05tWtbgAnc14qBXM7hPHrqyEVQ7tCi
Unseal Key 4: KBVhzztVDUJRqNi2LDYfRFHThQe/iDbNdEaOFkAztMDN
Unseal Key 5: GJplvpcPVu6IQeJ3lqa5xvPfXTDA3ftgcZJT6xhrAUUL
Initial Root Token: s.RcW0LuNIyCoTLWxrDPtUDkCw
Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.
Vault does not store the generated master key. Without at least 3 key to
reconstruct the master key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.
Once you “Unseal” Vault, use Initial Root Token to Sign in to Vault.
You should see Vault web dashboard in the next page.
You can also view Vault status from CLI.
$ vault status
Key Value
--- -----
Seal Type shamir
Initialized true
Sealed false
Total Shares 5
Threshold 3
Version 1.0.3
Cluster Name vault
Cluster ID 92ed9909-8088-a797-d5be-768d8c09ce27
HA Enabled false
Test HTTP API endpoint using curl to check initialization status.
Other Authentication Methods can also be enabled from the Web interface.
ACL Policies can be managed from the Web Console “Policies” section.
Write and get Secrets
Now that we have installed and configured our vault server, let’s write and retrieve secrets in Vault. We use vault kv to write secrets.
Get secret engine path:
$ vault secrets list
Path Type Accessor Description
---- ---- -------- -----------
cubbyhole/ cubbyhole cubbyhole_4cf73c3d per-token private secret storage
identity/ identity identity_248343db identity store
secret/ kv kv_30258a59 key/value secret storage
sys/ system system_cbeaa203 system endpoints used for control, policy and debugging
Write a secret to your kv secret engine.
$ vault kv put secret/databases/db1 username=DBAdmin
Success! Data written to: secret/databases/db1
$ vault kv put secret/databases/db1 password=StrongPassword
Success! Data written to: secret/databases/db1
You can even use single line command to write multiple data.
$ vault kv put secret/databases/db1 username=DBAdmin password=StrongPassword
Success! Data written to: secret/databases/db1
To get a secret, use vault get command.
$ vault kv get secret/databases/db1
====== Data ======
Key Value
--- -----
password StrongPassword
username DBAdmin
$ vault kv get -field=username secret/databases/db1
DBAdmin
To delete a Secret, use:
$ vault kv delete secret/databases/db1
Success! Data deleted (if it existed) at: secret/databases/db1
$ vault kv get secret/databases/db1
No value found at secret/databases/db1
A systems engineer with excellent skills in systems administration, cloud computing, systems deployment, virtualization, containers, and a certified ethical hacker.
