Hashicorp Vault: Open Source Secrets Management at #OPEN18
•
3 likes•2,564 views
HashiCorp Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. We'll show how this works.
Report
Share
Hashicorp Vault: Open Source Secrets Management at #OPEN18
- 2. WHAT IS A SECRET? Security-sensitive information Personally-identifiable information (PII) DB User/Pass, AWS IAM Credentials, SSL Keys, Encryption Keys Anything that would make the news
- 3. HOW DO I DISTRIBUTE SECRETS? How do applications get secrets? How do operators get secrets? How do secrets get updated? How do secrets get revoked?
- 4. VAULT GOALS Single source for Secrets Programmatic Application Access (Automated) Operator Access (Manual) Practical Security Modern Data Center Friendly
- 5. VAULT FEATURES Secure Secret Storage (in-memory, Consul, file, and more) Dynamic Secrets Leasing, Renewal, and Revocation Auditing Rich ACLs Multiple Client Authentication Methods
- 6. SECURE SECRET STORAGE Data is encrypted in transit and at rest 256bit AES in GCM mode TLS 1.2 for clients No HSM required
- 7. Success! Data written to: secret/foo secure master vault write secret/foo bar=bacon
- 8. Key Value lease_id secret/foo/2a798f6f-00da-8d48-659a-ef1c969f23ed lease_duration 2592000 lease_renewable false bar bacon secure master vault read secret/foo
- 9. UNSEALING THE VAULT Data in Vault encrypted Vault requires encryption key Must be provided online
- 10. Sealed: true Key Shares: 10 Key Threshold: 7 Unseal Progress: 6 High-Availability Enabled: false secure master vault status
- 11. Key (will be hidden): secure master vault unseal
- 12. Key (will be hidden): Sealed: false Key Shares: 10 Key Threshold: 7 Unseal Progress: 0 secure master vault unseal
- 13. DYNAMIC SECRETS Never provide “root” credentials to clients Provide limited access credentials based on role Generated on demand when requested Leases are enforceable via revocation Audit trail can identify point of compromise
- 14. Successfully mounted 'postgresql' at 'postgresql'! secure master vault mount postgresql
- 15. ## DESCRIPTION The PostgreSQL backend dynamically generates database users. After mounting this backend, configure it using the endpoints within the "config/" path. ## PATHS The following paths are supported by this backend. To view help for any of the paths below, use the help command with any route matching the path pattern. Note that depending on the policy of your auth token, secure master vault help postgresql
- 16. vault write postgresql/config/connection value="user=hashicorp password=hashicorp database=hashicorp" Success! Data written to: postgresql/config/connection secure master
- 17. vault write postgresql/roles/production name=production Success! Data written to: postgresql/roles/production secure master
- 18. Key Value lease_id postgresql/creds/production/2d483e34-2d82-476... lease_duration 3600 lease_renewable true password 80e6ffa5-d6e9-beb1-e630-9af0c41299bb username vault-root-1432058168-8081 secure master vault read postgresql/creds/production
- 19. Key Value lease_id postgresql/creds/production/a99b952e-222c-6eb... lease_duration 3600 lease_renewable true username vault-root-1432058254-7887 password 17a21ba7-8726-97e4-2088-80b7a756702b secure master vault read postgresql/creds/production
- 20. DYNAMIC SECRETS Pluggable Backends AWS, Consul, PostgreSQL, MySQL, Transit, Generic Grow support over time
- 21. LEASING, RENEWAL, AND REVOCATION Every Secret has a Lease* Secrets are revoked at the end of the lease unless renewed Secrets may be revoked early by operators “Break Glass” procedure Dynamic Secrets make leases enforceable Not possible for arbitrary secrets Not possible for transit backend
- 22. AUDITING Pluggable Audit Backends Request and Response Logging Prioritizes Safety over Availability Secrets Hashed in Audits Searchable, but not reversible
- 23. RICH ACLS Role Based Policies Restrict access to “need to know” Default Deny, must be explicitly allowed
- 24. FLEXIBLE AUTH Pluggable Backends Tokens, GitHub, AppID, User/Pass, TLS Certs Machine-Oriented vs Operator-Oriented
- 25. HIGH AVAILABILITY Consul used for leader election Active/Standby Automatic failover
- 26. THANK YOU! QUESTIONS? ! hashicorp/vault " https://vaultproject.io # security@hashicorp.com