6
votes
Accepted
How does Hashicorp's Vault compare to Lastpass?
I don't have enough rep to comment but I'm going to expand on what RuBiCK said.
In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with ...
- 1,112
5
votes
Accepted
Is Hashicorp's Vault suitable for personal projects as well?
Vault will distribute multiple unseal keys but there's nothing to stop you from keeping all of the keys in one place for a personal project.
The one time I did it I set the keys to 3 and kept them in ...
- 1,112
4
votes
Accepted
How to unseal a Vault in practice?
I assume your vault would be being accessed over a network, so you would ask a colleague to use their own command line on their own workstation to enter their key. Mine requires 3 keys to unseal so I ...
- 211
3
votes
Accepted
Is it possible to recover accidentally deleted HashiCorp's Vault secrets?
If your secret backend is a separate service, which it should be, then with regular backups you should be able to stop vault, replace the backend with a backup and be good to go.
I've done this for a ...
- 1,112
3
votes
Access vault secret from bash script
This mighty be a lengthy procedure but worth implementing, creating child tokens to fetch information from Vault Server.
Execute following procedure at Vault Server.
Create policy to restrict the ...
- 139
3
votes
Access vault secret from bash script
The vault docs mention a -field parameter for the read subcommand. So you should be able to put this into a shell script:
SECRET=$(vault read -field foo secret/mysecret)
Other vault docs use the ...
- 1,893
3
votes
Accepted
Vault `SSH-CA` Elliptic Curve rather than `RSA`
I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.
You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot ...
- 46
3
votes
Accepted
Is there an organization that offers a Hashicorp Vault SaaS solution?
It seems that Hashicorp itself offers an enterprise solution including 24x7 gold support called Hashicorp Vault premium enterprise.
- 13.3k
3
votes
Accepted
What are best practices for sharing and accessing Vault secrets?
Assuming person B has a role which also allows them access to the path secret/hello, then they would simply run vault read secret/hello from their own machine.
If you're following the demo, I think ...
- 211
2
votes
How does Hashicorp's Vault compare to Lastpass?
Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts.
Use HashiCorp's Vault or any other solution like Amazon KMS for ...
- 305
1
vote
Best practices of authentication to Vault
The key factor here is that the credential that you use to authenticate to Vault should be short-lived. So in case it gets stolen the attacker will have only a very limited time to use it.
Of all the ...
- 121
1
vote
How to use Hashicorp Vault with NodeJS application?
As the Linux philosophy says:
Make each program do one thing well
So it's worth it to use the vault agent, cause it's doing well what it would be done.
You can find an awesome example here
- 359
1
vote
Accepted
How to protect secrets whilst enabling the ability to amend a pipeline
Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would ...
- 920
1
vote
Is there an organization that offers a Hashicorp Vault SaaS solution?
To my knowledge there are no services today that offer Vault SaaS. However, if you're looking for a better UI/UX, there are great options out there for a Vault UI (A full Hashicorp supported list can ...
1
vote
Hashicorp vault not writing out KV
You have your VAULT_ADDR set to HTTP, but vault is listening on TLS - the error you are receiving is the HTTP request receiving a TLS handshake.
Try changing VAULT_ADDR to https://mydomain.com.
- 111
1
vote
Planning a backup system using postgress, chef and vault
First chef runs as often as you configure it to do.
Second Chef is a configuration management system and not a crontab or an orchestration system.
Use chef to configure cron (that can not be not an ...
- 11.4k
1
vote
Accepted
Why not run a stateless Hashicorp Vault in production?
I think you're misunderstanding what is considered bad practice.
Running vault with an in memory backend and being able to spin it up and provision it is fine. What is Not Fine is seeding the secrets ...
- 1,754
1
vote
Accepted
Recommended Design - Communication among Jenkins + Vault + App
My choice would be design B.
It's true that the availability of the Vault would be crucial, but Jenkins' availability would similarly be crucial in design A. So from this perspective the decision ...
- 6,750
1
vote
Accepted
When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?
According to this documentation, each vault has to be unsealed in a HA setup.
Now you need to initializing and unsealing each Vault instance.
# Initialize vault_s1
$ vault operator init
# Unseal ...
- 13.3k
1
vote
How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance
The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself.
Example from the Terraform site:
provider "...
- 141
1
vote
Accepted
What does implementing Hashicorp Vault mean in practice?
In the hope of resurrecting this question, I will give my opinionated answer.
As I understand it, the use of Vault is part of the drive to give more autonomy to teams, by removing fear of leaking or ...
- 3,743
1
vote
Why HashiCorp vault returning null?
If you are unsure what happened, try deploying it in AWS via AWS vault quickstarts. They deploy vault end-to-end, so now you can compare it to yours and find out what was the problem.
- 51
1
vote
Access vault secret from bash script
I've ended up at exactly the same spot.
We have a Vault server holding a good deal of secrets for different environments and various endpoints for each environment, so we set up kv engines for every ...
- 11
1
vote
Is Hashicorp's Vault suitable for personal projects as well?
One thing you should know is, even though you can backup vault(consul, if you are using one as backend), you cannot restore to a new vault installation (if you loose the existing one). You can just ...
- 51
1
vote
What are best practices for running Hashicorp's Vault in terms of high availability?
Well, the first step is to use a backend which supports HA. Consul, for example, supports HA. If you are not an enterprise customer, you may have to run a shell script via cron to upload consul ...
- 51
1
vote
Accepted
What are best practices for running Hashicorp's Vault in terms of high availability?
According to this documentation two vault servers have to be run. One of them has to be active and the other passive. In order to run such a setup both vault servers need to be unsealed.
- 13.3k
1
vote
Use Vault SSH OTP backend with Jenkins
I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.
It depends how the current configuration looks like that is used to deploy apps.
https://github.com/...
- 13.3k
Only top scored, non community-wiki answers of a minimum length are eligible