How to unseal a Vault in practice?

Question

It is possible to force that multiple keys have to be entered in order to unseal the vault. How does this work in practice? If someone has entered a key and there is another key required to unseal the vault should one ask a colleague to enter another key and how should this be done to prevent that colleague A or someone else sees that key?

Answer 1

I assume your vault would be being accessed over a network, so you would ask a colleague to use their own command line on their own workstation to enter their key. Mine requires 3 keys to unseal so I just have 3 users independently enter the vault unseal command with their key.

Answer 2

I agree with @alitheg answer, and to add two my cents, sequence of commands to be executed by you or any 3 colleagues of yours who has possession of the vault unseal token

export VAULT_ADDR=https://vault.yourcompany.com  # Address of your Vault
export VAULT_SKIP_VERIFY=true                    # this can be skipped, if you use a proper certificate and not self-signed certificate
vault status                                     # to check the vault status
vault unseal                                     # this will ask for the vault unseal token