by Alexandre Nestor<\/p>\n\n\n\n
Keeping and using passwords in scripts is often an overlooked task, at least in the initial stages of development.
This behavior poses serious security problems, and quite often, especially in scripts, one can find plaintext passwords.
If the project uses Git, then the versions of git that contain the passwords are visible in the project history.
The use of a vault should be implemented in the first phase of every project.<\/p>\n\n\n\n
This post describes how to install and use the HashiCorp Vault, in a Podman container.<\/p>\n\n\n\n
https:\/\/github.com\/hashicorp\/docker-vault<\/a> As these tests are made on a brand new cloud Ubuntu vm, let’s start from the beginning by :<\/p>\n\n\n\n Let’s init the vault and save the Save whole JSON output in a
https:\/\/hub.docker.com\/_\/vault<\/a><\/p>\n\n\n\n<\/h4>\n\n\n\n
Installation <\/h2>\n\n\n\n
Install Podman<\/a><\/h4>\n\n\n\n
Installing
podman<\/code>.<\/h4>\n\n\n\nroot@blog-vault:~# apt-get install podman\n....\n<\/pre><\/div>\n\n\n
Create a
vault<\/code> user.<\/h4>\n\n\n\nroot@blog-vault:~# useradd vault --home \/home\/vault --create-home --shell \/bin\/bash\nroot@blog-vault:~# sudo su - vault\nvault@blog-vault:~$\n\nroot@blog-vault:~# id vault\nuid=1002(vault) gid=1002(vault) groups=1002(vault)\n\nroot@blog-vault:~# loginctl enable-linger 1002\n<\/pre><\/div>\n\n\n
Get the
podman<\/code> vault container:<\/h4>\n\n\n\nubuntu@blog-vault:~$ podman login registry.connect.redhat.com\nUsername: your_username\nPassword: ********\nLogin Succeeded!\n\nvault@blog-vault:~$ podman pull registry.connect.redhat.com\/hashicorp\/vault:1.12.1-ubi\nTrying to pull registry.connect.redhat.com\/hashicorp\/vault:1.12.1-ubi...\nGetting image source signatures\nCopying blob 4a6625bea753 done\nCopying blob 7c43afe89fe5 done\nCopying blob 66304ec43437 done\nCopying blob 35f159681384 done\nCopying blob baed4ec80d13 done\nCopying blob c4a8cf07892e done\nCopying blob 7ea744a06738 done\nCopying config 11bd373e3f done\nWriting manifest to image destination\nStoring signatures\n11bd373e3fd8c82d9e86c5143572ca79c90962ccc72cb15fab4449790bcdbd35\n\nvault@blog-vault:~$ podman images\nREPOSITORY TAG IMAGE ID CREATED SIZE\nregistry.connect.redhat.com\/hashicorp\/vault 1.12.1-ubi 11bd373e3fd8 2 months ago 350 MB\n<\/pre><\/div>\n\n\n
Create the directories for the vault container external storage.<\/h4>\n\n\n
\nvault@blog-vault:~$ mkdir -p $HOME\/vault\/logs\nvault@blog-vault:~$ mkdir -p $HOME\/vault\/file\nvault@blog-vault:~$ mkdir -p $HOME\/vault\/config\n<\/pre><\/div>\n\n\n
Create the vault configuration file.<\/h4>\n\n\n
\nvault@blog-vault:~$ cat vault\/config\/local.json\n{\n "storage": {\n "file": {\n "path": "\/vault\/file"\n }\n },\n "listener": [\n {\n "tcp": {\n "address": "0.0.0.0:8200",\n "tls_disable": true\n }\n }\n ],\n "default_lease_ttl": "168h",\n "max_lease_ttl": "720h",\n "ui": true\n}\n<\/pre><\/div>\n\n\nStart the vault
podman<\/code> container<\/h4>\n\n\n\nvault@blog-vault:~$ podman run --cap-add=IPC_LOCK \\\n-v $HOME\/vault\/logs:\/vault\/logs \\\n-v $HOME\/vault\/config:\/vault\/config \\\n-v $HOME\/vault\/file:\/vault\/file \\\n-e 'SKIP_CHOWN=true' \\\n-e 'SKIP_SETCAP=true' \\\n-p 8200:8200 vault server\n\n==> Vault server configuration:\n\n Cgo: disabled\n Go Version: go1.19.2\n Listener 1: tcp (addr: "0.0.0.0:8200", cluster address: "0.0.0.0:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")\n Log Level: info\n Mlock: supported: true, enabled: true\n Recovery Mode: false\n Storage: file\n Version: Vault v1.12.1, built 2022-10-27T12:32:05Z\n Version Sha: e34f8a14fb7a88af4640b09f3ddbb5646b946d9c\n\n==> Vault server started! Log data will stream in below:\n\n2023-01-10T09:22:18.628Z [INFO] proxy environment: http_proxy="" https_proxy="" no_proxy=""\n2023-01-10T09:22:18.628Z [WARN] no `api_addr` value specified in config or in VAULT_API_ADDR; falling back to detection if possible, but this value should be manually set\n2023-01-10T09:22:18.651Z [INFO] core: Initializing version history cache for core\n<\/pre><\/div>\n\n\n
Configure the vault<\/h2>\n\n\n\n
First init of the vault<\/h4>\n\n\n\n
root_token<\/code> in an env variable for easy use. <\/p>\n\n\n\ninit_vault.json<\/code> file.<\/p>\n\n\n