私密信息管理工具 Vault 快速入门

什么是 Vault

Vault 是一个基于身份的秘密和加密管理系统。秘密是您想要严格控制访问的任何内容，例如 API 加密密钥、密码和证书。 Vault 提供由身份验证和授权方法控制的加密服务。使用 Vault 的 UI、CLI 或 HTTP API，可以安全地存储和管理、严格控制（限制）和审核对机密和其他敏感数据的访问。

为什么需要 Vault

• 执行密码轮换策略很痛苦

• 掌握机密的员工离职后可能泄密或是恶意报复

• 开发者不小心把机密信息随着代码上传到公网的源码仓库造成泄密

• 管理多个系统的机密非常麻烦

• 需要将机密信息安全地加密后存储，但又不想将密钥暴露给应用程序，以防止应用程序被入侵后连带密钥一起泄漏

Vault 架构图

Vault 只暴漏了存储后端(Storage Backend) 和 API，其他部分都被保护起来了。Vault 并不信任后端存储，存放的都是密文。

安装

此处以 Mac 为例，其他平台参考官方文档Vault 安装向导

❯  brew  tap  hashicorp/tap

❯  brew  install  hashicorp/tap/vault

启动 Vault(Dev 模式)

❯  vault  server  -dev

WARNING!  dev  mode  is  enabled!  In  this  mode,  Vault  runs  entirely  in-memory

and  starts  unsealed  with  a  single  unseal  key.  The  root  token  is  already

authenticated  to  the  CLI,  so  you  can  immediately  begin  using  Vault.

  

You  may  need  to  set  the  following  environment  variables:

  

$  export  VAULT_ADDR='http://127.0.0.1:8200'

  

The  unseal  key  and  root  token  are  displayed  below  in  case  you  want  to

seal/unseal  the  Vault  or  re-authenticate.

  

Unseal  Key:  QNqS6xZOnJKsbcz60PThJE2O070F2+9b7LLrGGgI7os=

Root  Token:  hvs.IKbh5pTGI0Qn08G5QNJb4jPY

  

Development  mode  should  NOT  be  used  in  production  installations!

查看服务状态

❯  vault  status

Key  Value

---  -----

Seal  Type  shamir

Initialized  true

Sealed  false

Total  Shares  1

Threshold  1

Version  1.12.1

Build  Date  2022-10-27T12:32:05Z

Storage  Type  inmem

Cluster  Name  vault-cluster-c5c1f8a4

Cluster  ID  60514532-959b-9540-ea21-5d9c968a21ba

HA  Enabled  false

写入第一个密码

❯  vault  write  kv/infini  value=infinilabs

Success!  Data  written  to:  kv/infini

如果报这个错误:

vault write kv/infini value=infinilabs

Error writing data to kv/cheng: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/kv/cheng

Code: 404. Errors:

• no handler for route ‘kv/cheng’

是因为 kv 存储没有启动(不同版本默认初始设置不同)，执行:

❯  vault  secrets  enable  kv

读取一条数据

❯  vault  read  kv/infini

Key  Value

---  -----

refresh_interval  768h

value  labs

使用 Consul 作为数据存储的 Backend

Vault 自身不存储数据，需要提供存储后台。 支持多种后台。

❯  brew  tap  hashicorp/tap

❯  brew  install  hashicorp/tap/consul

启动 Consul

❯  consul  agent  -dev

==> Starting  Consul  agent...

Version:  '1.14.1'

Build  Date:  '2022-11-21 16:56:07 +0000 UTC'

Node  ID:  '6d9bcfc4-60cf-5d9b-c4fa-764127a94af6'

Node  name:  'ChengKai-MacBook.local'

Datacenter:  'dc1' (Segment: '<all>')

Server:  true (Bootstrap: false)

Client  Addr: [127.0.0.1] (HTTP:  8500,  HTTPS:  -1,  gRPC:  8502,  gRPC-TLS:  8503,  DNS:  8600)

Cluster  Addr:  127.0.0.1 (LAN: 8301,  WAN:  8302)

Gossip  Encryption:  false

Auto-Encrypt-TLS:  false

HTTPS  TLS:  Verify  Incoming:  false,  Verify  Outgoing:  false,  Min  Version:  TLSv1_2

gRPC  TLS:  Verify  Incoming:  false,  Min  Version:  TLSv1_2

Internal  RPC  TLS:  Verify  Incoming:  false,  Verify  Outgoing:  false (Verify Hostname:  false), Min Version: TLSv1_2

  

==> Log  data  will  now  stream  in  as  it  occurs:

  

2022-11-30T16:34:52.604+0800 [WARN] agent: Node name "ChengKai-MacBook.local" will not be discoverable via DNS due to invalid characters. Valid characters include all alpha-numerics and dashes.

2022-11-30T16:34:52.609+0800 [WARN] agent.auto_config: Node name "ChengKai-MacBook.local" will not be discoverable via DNS due to invalid characters. Valid characters include all alpha-numerics and dashes.

2022-11-30T16:34:52.613+0800 [INFO] agent.server.raft: initial configuration: index=1 servers="[{Suffrage:Voter ID:6d9bcfc4-60cf-5d9b-c4fa-764127a94af6 Address:127.0.0.1:8300}]"

2022-11-30T16:34:52.614+0800 [INFO] agent.server.raft: entering follower state: follower="Node at 127.0.0.1:8300 [Follower]" leader-address= leader-id=

启动 Vault(生产模式)

创建配置文件，使用刚刚启动的 Consul 作为存储后台。

注意: 这种方式启动，为生产模式，需要手动配置和管理秘钥。

storage "consul"{

address = "127.0.0.1:8500"

path = "vault/"

}

  

listener "tcp"{

address = "127.0.0.1:8200"

tls_disable = 1

}

执行命令，启动

❯  vault  server  -config=config.hcl

WARNING!  mlock  is  not  supported  on  this  system!  An  mlockall(2)-like  syscall  to

prevent  memory  from  being  swapped  to  disk  is  not  supported  on  this  system.  For

better  security,  only  run  Vault  on  systems  where  this  call  is  supported.  If

you  are  running  Vault  in  a  Docker  container,  provide  the  IPC_LOCK  cap  to  the

container.

==> Vault  server  configuration:

  

Api  Address:  http://127.0.0.1:8200

Cgo:  disabled

Cluster  Address:  https://127.0.0.1:8201

Go  Version:  go1.19.2

Listener  1:  tcp (addr: "127.0.0.1:8200",  cluster  address:  "127.0.0.1:8201",  max_request_duration:  "1m30s",  max_request_size:  "33554432",  tls:  "disabled")

Log  Level:  info

Mlock:  supported:  false,  enabled:  false

Recovery  Mode:  false

Storage:  consul (HA available)

Version:  Vault  v1.12.1,  built  2022-10-27T12:32:05Z

Version  Sha:  e34f8a14fb7a88af4640b09f3ddbb5646b946d9c

  

==> Vault  server  started!  Log  data  will  stream  in  below:

  

2022-11-30T16:42:59.995+0800 [INFO] proxy environment: http_proxy="" https_proxy="" no_proxy=""

2022-11-30T16:43:00.006+0800 [WARN] no `api_addr`  value  specified  in  config  or  in  VAULT_API_ADDR; falling  back  to  detection  if  possible,  but  this  value  should  be  manually  set

注意: 此时虽然服务启动了，但是 Vault 处于封印状态(sealed)， 不可用。

此时我们执行操作，会看到如下提示:

❯  vault  read  kv/cheng

Error  reading  kv/cheng:  Error  making  API  request.

  

URL:  GET  http://127.0.0.1:8200/v1/kv/cheng

Code:  503.  Errors:

  

* Vault is sealed

上面 Dev 模式启动的 Vault 实际上帮助我们自动地把创建主密钥、解封的步骤都完成了。生产模式，则需要手动配置后续步骤。

补充点小知识

• Vault 保存在 Backend 中的数据都是加密的

• Vault 密钥称为 Master Key 主密钥，Vault 默认使用 Shamir 算法，把主密钥切分成 M 份，管理员必须至少提供其中的 N 份才能还原出主密钥（这里的 M 和 N 都是可配置的，M>=N）理想状态下，我们必须把这 M 份密钥分配给公司内 M 个不同的人，只有在获取其中 N 个人的授权后，Vault 才可以成功解密主密钥。

Vault 初始化(生产模式)

注意看，接下来的步骤，会生成 5 个秘钥，一个 Root 用户的 Token。真实场景下，这 5 个秘钥会分配给 5 个不同的人员管理。 至少正确输入 3 个秘钥，才能解封 Vault。

热知识: Vault 每次启动/重启，都会进入封印状态，未解封时，几乎无法执行任何操作。

> vault operator init

Unseal Key 1: IDcHr5kT7hhgYKiDxF6Qlp2g11UVXNu+f5VX51+3jpeD

Unseal Key 2: dfjqn++KcqLDIDnBcE8B0fIvicI7T9TQCxBSI7b1oE12

Unseal Key 3: DaFtgnYsm0rTQcPpLTPaDTNW338BHhyhezct+ySTT45L

Unseal Key 4: Z1vmlLm/KBydeLrmVf9ELqlJoaUgwzNvzx6ddXttc4Nk

Unseal Key 5: x2lIwJiCz3lNqzBPzkryrnatfZT9mahj3yfW4qxT3eMZ

  

Initial Root Token: s.o7NjzR6qXEvJEwPYpmVFOt4P

  

Vault initialized with 5 key shares and a key threshold of 3. Please securely

distribute the key shares printed above. When the Vault is re-sealed,

restarted, or stopped, you must supply at least 3 of these keys to unseal it

before it can start servicing requests.

  

Vault does not store the generated master key. Without at least 3 keys to

reconstruct the master key, Vault will remain permanently sealed!

  

It is possible to generate new unseal keys, provided you have a quorum of

existing unseal keys shares. See "vault operator rekey" for more information.

Vault 默认访问 https 的地址，所以如果执行初始化报如下错误:

Error authenticating: error looking up token: Get "https://127.0.0.1:8200/v1/auth/token/lookup-self": http: server gave HTTP response to HTTPS client

设置一下 Vault 地址即可，执行:

export VAULT_ADDR=‘http://127.0.0.1:8200’

查看 Vault 状态

此时 Vault 处于封印状态(Sealed 为 true)

❯  vault  status

Key  Value

---  -----

Seal  Type  shamir

Initialized  true

Sealed  true

Total  Shares  5

Threshold  3

Unseal  Progress  0/3

Unseal  Nonce  n/a

Version  1.9.2

Storage  Type  consul

HA  Enabled  true

解封 Vault

使用需要 vault operator unseal 命令来执行解封。至少需要 3 个秘钥来解封。

❯  vault  operator  unseal  IDcHr5kT7hhgYKiDxF6Qlp2g11UVXNu+f5VX51+3jpeD

Key  Value

---  -----

Seal  Type  shamir

Initialized  true

Sealed  true

Total  Shares  5

Threshold  3

Unseal  Progress  1/3

Unseal  Nonce  9eeaaa92-d673-51d3-b993-d3affe68b5a3

Version  1.9.2

Storage  Type  consul

HA  Enabled  true

注意: 每次输入一个秘钥，会看到如上提示"Unseal Progress 1/3"。 但是，这里仅仅表示已经输入多少个秘钥，并不代表输入的秘钥都是正确的!!

如何使用 Vault 保存秘密

进入下一步之前，先来看看 Vault 提供了哪些措施，用来保护我们的秘密？

• 秘钥的保护机制: 秘钥被拆分成 5 份，至少正确输入 3 个才能解封。

• 策略控制(权限控制): 可以针对每个 Path 设置策略。

• 有效期: Vault 生成的每个令牌(Token)都有有效期。

开始前，我们先写入 2 条测试数据:

❯  vault  write  kv/infini  value=infinilabs

Success!  Data  written  to:  kv/infini

  

❯  vault  write  kv/ck  value=chengkai

Success!  Data  written  to:  kv/ck

  

热知识:

“kv/infini” 是一个 Path(路径), 可以简单理解为数据库中的一个表。并不是 kv 数据库 当中的 key。你可以试试这样存数据并读取:

❯  vault  write  kv/infini  ck=chengkai  c=cheng  k=kai

Success!  Data  written  to:  kv/infini

  

❯  vault  read  kv/infini

Key  Value

---  -----

refresh_interval  768h

c  cheng

ck  chengkai

k  kai

制定策略

新建策略文件

输入以下内容

path  "kv/infini"  {

capabilities  = ["read"]

}

解释: 以上策略，是指在 infini 这个路径(path)下，具有只读权限。

创建策略

先登录已经解封的 Vault(使用初始化生成的 root token 登录)

❯  vault  login  s.o7NjzR6qXEvJEwPYpmVFOt4P

Success!  You  are  now  authenticated.  The  token  information  displayed  below

is  already  stored  in  the  token  helper.  You  do  NOT  need  to  run  "vault login"

again.  Future  Vault  requests  will  automatically  use  this  token.

  

Key  Value

---  -----

token  s.o7NjzR6qXEvJEwPYpmVFOt4P

token_accessor  tKZyxkkFvrmhQeTsoDOogcoV

token_duration  ∞

token_renewable  false

token_policies ["root"]

identity_policies []

policies ["root"]

❯  vault  policy  write  infini-readonly  policy.hcl

Success!  Uploaded  policy:  infini-readonly

“infini-readonly” 是策略的名称，这个可以自定义

生成 Token 并指定策略

生成对"kv/infini"具有只读权限的 Token, 执行:

❯  vault  token  create  -policy="infini-readonly"

Key  Value

---  -----

token  s.bHzsfREs9MGirYO8yZ2TbAzq

token_accessor  nPuAQzNTn28vMMUKcDu0mN8g

token_duration  768h

token_renewable  true

token_policies ["infini-readonly"  "default"]

identity_policies []

policies ["infini-readonly"  "default"]

此处生成了新的 Token: s.bHzsfREs9MGirYO8yZ2TbAzq， 有效期 768 小时(别拿计算器了，我算过了，32 天)

使用新生成的 Token 登录(别找退出操作了，直接再执行 login 即可):

❯  vault  login  s.bHzsfREs9MGirYO8yZ2TbAzq

Success!  You  are  now  authenticated.  The  token  information  displayed  below

is  already  stored  in  the  token  helper.  You  do  NOT  need  to  run  "vault login"

again.  Future  Vault  requests  will  automatically  use  this  token.

  

Key  Value

---  -----

token  s.bHzsfREs9MGirYO8yZ2TbAzq

token_accessor  nPuAQzNTn28vMMUKcDu0mN8g

token_duration  767h56m19s

token_renewable  true

token_policies ["infini-readonly"  "default"]

identity_policies []

policies ["infini-readonly"  "default"]

验证新生成的 Token

尝试读 kv/infini 的秘密:

❯  vault  read  kv/infini

Key  Value

---  -----

refresh_interval  768h

value  infinilabs

Wow！成功读取！

试试写入操作

❯  vault  write  kv/infini  value=c1

Error  writing  data  to  kv/cheng:  Error  making  API  request.

  

URL:  PUT  http://127.0.0.1:8200/v1/kv/infini

Code:  403.  Errors:

  

* 1 error occurred:

*  permission  denied

有个疑问，你说当前这个 Token，可以读取 kv/ck 的秘密吗?

❯  vault  read  kv/ck

Error  reading  kv/ck:  Error  making  API  request.

  

URL:  GET  http://127.0.0.1:8200/v1/kv/ck

Code:  403.  Errors:

  

* 1 error occurred:

*  permission  denied

啊欧! 不行~

OK, 到这里了，简单的对 Vault 做了个入门。 Vault 的功能点还有很多，去看看下面的文档吧~~

参考文档

• [1]: Vault 官方文档

• [2]: Vault 教程(中文)

• [3]: How To Securely Manage Secrets with HashiCorp Vault on Ubuntu 20.04