Vault 實作 - HackMD

{%hackmd SybccZ6XD %} <style> .toc li:first-child { display: none; } </style> Vault 實作 === ###### tags: `Vault` `DIY` --- [TOC] --- # Server 設定 ```json= { "storage": { "mysql": { "address": "127.0.0.1:3306", "database": "playground", "table": "vault", "username": "root", "password": "mysql-password", "plaintext_connection_allowed": true, "ha_enabled": true } }, "listener": { "tcp": { "tls_disable": true } }, "seal": { "awskms": { "region": "ap-northeast-1", "access_key": "aws-iam-access-key", "secret_key": "aws-iam-secret-key", "kms_key_id": "aws-kms-key-id" } }, "ui": true, "disable_mlock": true, "api_addr": "http://127.0.0.1:8200", "cluster_addr": "https://127.0.0.1:8201" } ``` ```bash= $ vault server -config=config.json ``` --- # Seal/Unseal 初始化並獲得 `Recovery Key` 和 `Root Token` ```bash= $ vault operator init -recovery-shares=1 -recovery-threshold=1 Recovery Key 1: fFtAyv+N/h4YdgQmLveOleONswIYmNorw6E65Jv7ciU= Initial Root Token: s.9gFtHEu35b4FCBHbUtaLxeOw ``` ```bash= $ vault status Key Value --- ----- Recovery Seal Type shamir Initialized true Sealed false Total Recovery Shares 1 Threshold 1 Version 1.6.1 Storage Type mysql Cluster Name vault-cluster-d4a98a31 Cluster ID 06bbee1f-d643-31c1-a87b-ba43d3b1d2d3 HA Enabled true HA Cluster https://127.0.0.1:8201 HA Mode active ``` ## MySQL 可以看到主鑰和加密金曜都已經建立好了 ``` vault_key vault_value --------- ----------- core/keyring ... core/master ... ``` ## Login ```bash= $ vault login s.9gFtHEu35b4FCBHbUtaLxeOw ``` ## Seal 重新封印並再解封的話要輸入 `Recovery Key` > 注意：若重新申請一個 `Root Token`，也會需要 `Recovery Key` ```bash= $ vault operator seal $ vault operator unseal Unseal Key (will be hidden): ``` # Secrets key-value 的資料庫 ```bash= $ vault secrets enable -path=secret kv $ vault kv put secret/hello foo=world $ vault kv list secret $ vault kv get secret/hello ``` ## MySQL 可以看到資料庫依此建立了新的路徑，`secret/hello` 中的 `secret` 被加密了 ``` vault_key vault_value --------- ----------- logical/beefac89-6bc8-6bfd-1af8-c1436c19926c/hello ... ``` # Authentication 先允許 GitHub 登入 ```bash= $ vault auth enable github $ vault write auth/github/config organization=104corp ``` ## 登出 ```bash= $ rm ~/.vault-token ``` ## GitHub ### 存取權杖去 [GitHub 設定頁](https://github.com/settings/profile) > Developer settings > Personal access tokens > Generate new token 權限要有：`admin:org > read:org`，讓 Vault 可以讀取你帳號的組織 ### 登入 ```bash= $ vault login -method=github -token=access-token-from-github Key Value --- ------ token s.AtDndppL6auMYfI27zfkvgn1 token_accessor WC8tFkMglS9S3RLtitHdAtRe token_duration 768h token_renewable true token_policies ["default"] identity_policies [] policies ["default"] token_meta_username evan361425 token_meta_org 104corp ``` ### 資訊 ```bash= $ vault token lookup s.AtDndppL6auMYfI27zfkvgn1 Key Value --- ----- accessor WC8tFkMglS9S3RLtitHdAtRe creation_time 1610344081 creation_ttl 768h display_name github-evan361425 entity_id 7b404dd3-5b23-da3f-663c-76a66e84ebe8 expire_time 2021-02-12T13:48:01.492935+08:00 explicit_max_ttl 0s id s.AtDndppL6auMYfI27zfkvgn1 issue_time 2021-01-11T13:48:01.492956+08:00 meta map[org:104corp username:evan361425] num_uses 0 orphan true path auth/github/login policies [default] renewable true ttl 767h36m19s type service ``` # Token 先重新登入回 `Root Token` ```bash= # 看看現在是用什麼權杖 $ vault print token s.AtDndppL6auMYfI27zfkvgn1 # 此權杖並非 Root Token，登出 $ rm ~/.vault-token $ vault login s.9gFtHEu35b4FCBHbUtaLxeOw ``` ## 列出所有 token 的 accessor ```bash= $ vault list auth/token/accessors ``` ## Batch Token 先建立 [Policy](#Policy) ```bash= $ vault token create -type=batch -orphan=true -policy=my-policy Key Value --- ----- token b.AAAAAQKn0sVCMJNVTBWHXpwjQ1HbgpyDsJ8WeKtVaZiiUCLK13uT4-pknd0lsHyiXVw7jaRy2U03o0K-TjtEU40v5f26KZXiY12vlMakT1WZuL-NdQ6pGD9fj4YGRp39qKY_jbQyrx8 token_accessor n/a token_duration 768h token_renewable false token_policies ["default" "my-policy"] identity_policies [] policies ["default" "my-policy"] ``` batch token 開頭是 `b`，反之，常見的 token 是 `s` 開頭，代表 service token ## Wrapping Token ```bash= $ vault token create -policy=my-policy -wrap-ttl=120 Key Value --- ----- wrapping_token: s.F7S12zD0PUcEL5VShhElBZIb wrapping_accessor: LsfBV3JiC4zwWCaFEZqNW9db wrapping_token_ttl: 2m wrapping_token_creation_time: 2021-01-11 16:49:11.614054 +0800 CST wrapping_token_creation_path: auth/token/create wrapped_accessor: oW7NNQUM35G7mvTQ4vieDPqi ``` ```bash= vault unwrap s.F7S12zD0PUcEL5VShhElBZIb Key Value --- ----- token s.v8lwNg4uwfZzlHvDrmPdkRyF token_accessor oW7NNQUM35G7mvTQ4vieDPqi token_duration 768h token_renewable true token_policies ["default" "my-policy"] identity_policies [] policies ["default" "my-policy"] ``` ### API ```bash= $ curl \ --header "X-Vault-Token: s.9gFtHEu35b4FCBHbUtaLxeOw" \ --header "X-Vault-Wrap-TTL: 60" \ --request POST \ --data "{\"foo\": \"bar\"}" \ http://127.0.0.1:8200/v1/sys/wrapping/wrap { "request_id": "", "lease_id": "", "renewable": false, "lease_duration": 0, "data": null, "wrap_info": { "token": "s.3MeMoyxudk19RHKzCZAa55oi", "accessor": "6rKApXj7R8iNz3gZjkIpd8Y4", "ttl": 60, "creation_time": "2021-01-11T17:08:44.876296+08:00", "creation_path": "sys/wrapping/wrap" }, "warnings": null, "auth": null } ``` ----- ```bash= $ curl \ --header "X-Vault-Token: s.9gFtHEu35b4FCBHbUtaLxeOw" \ --request POST \ --data "{\"token\":\"s.3MeMoyxudk19RHKzCZAa55oi\"}" \ http://127.0.0.1:8200/v1/sys/wrapping/lookup { "request_id": "67be1f69-e921-0eac-a660-5aa4f2761cb1", "lease_id": "", "renewable": false, "lease_duration": 0, "data": { "creation_path": "sys/wrapping/wrap", "creation_time": "2021-01-11T17:11:00.784059+08:00", "creation_ttl": 60 }, "wrap_info": null, "warnings": null, "auth": null } ``` # Policy ## 讀取現有的政策 ```bash= $ vault read sys/policy Key Value --- ----- keys [default root] policies [default root] ``` ## 建立政策 ```bash= $ vault policy write my-policy policy.hcl ``` `policy.hcl` 檔： ```hcl path "secret/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/hello" { capabilities = ["deny"] } path "secret/restricted" { capabilities = ["create"] allowed_parameters = { "foo" = [] "bar" = ["zip", "zap"] } } ``` # High Availability Different from [config](#Server-設定) ```json= { "listener": { "tcp": { "address": "127.0.0.1:8100", "cluster_address": "127.0.0.1:8101" } } } ``` ```bash= $ export VAULT_ADDR="http://127.0.0.1:8100" $ vault status Key Value --- ----- Recovery Seal Type shamir Initialized true Sealed false Total Recovery Shares 1 Threshold 1 Version 1.6.1 Storage Type mysql Cluster Name vault-cluster-d4a98a31 Cluster ID 06bbee1f-d643-31c1-a87b-ba43d3b1d2d3 HA Enabled true HA Cluster https://127.0.0.1:8201 HA Mode standby Active Node Address http://127.0.0.1:8200 ``` # Rate Limit ```bash= $ vault read sys/quotas/config Key Value --- ----- enable_rate_limit_audit_logging false enable_rate_limit_response_headers false rate_limit_exempt_paths [ /v1/sys/generate-recovery-token/attempt /v1/sys/generate-recovery-token/update /v1/sys/generate-root/attempt /v1/sys/generate-root/update /v1/sys/health /v1/sys/seal-status /v1/sys/unseal ] ``` ## 存取、編輯 ```bash= $ vault write sys/quotas/rate-limit/global-rate rate=500 $ vault read sys/quotas/rate-limit/global-rate Key Value --- ----- block_interval 0 interval 1 name global-rate path n/a rate 500 type rate-limit ``` ```bash= $ vault write sys/quotas/rate-limit/global-rate rate=501 $ vault delete sys/quotas/rate-limit/global-rate ``` # Debug ```bash= $ vault debug ```