Vault – A tool for managing secrets
hashicorp.com
Vault – A tool for managing secrets
1–10 of 112 posts
Re: Vault – A tool for managing secrets
#2Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently.
I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?
Re: Vault – A tool for managing secrets
#3[deleted]
Re: Vault – A tool for managing secrets
#4Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently. I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?
Yes, otherwise - when keys travel with secrets - there would be absolutely no security.
This is akin to disk encryption where you have to type password on boot, but then data is accessible later.
Re: Vault – A tool for managing secrets
#5Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently. I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?
Haven't tried it yet, but most likely yes. But if you actually need vault and do spread the key to more than 2 people, you likely have more than one vault server running at a time.
Re: Vault – A tool for managing secrets
#6Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently. I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?
It does.
The solution to this problem is to run Vault in high availability mode[1]. This will have a set of stand-bys that can take over if the leader goes down. The idea is to unseal all the stand bys, and if the leader goes down, the standbys take over, and the sealed one can be unsealed at some other future point.
Security-sensitive things have been an interesting UX challenge for us, but this compromise comes at an expense of UX for a much better security promise. As one of the other comments says around this comment: without this feature there would be no real security for the stored data.
Re: Vault – A tool for managing secrets
#7Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently. I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?
It does. The solution to this problem is to run Vault in high availability mode[1]. This will have a set of stand-bys that can take over if the leader goes down. The idea is to unseal all the stand bys, and if the leader goes down, the standbys take over, and the sealed one can be unsealed at some other future point. Security-sensitive things have been an interesting UX challenge for us, but this compromise comes at…
Looks good. The post did not mention HA (that I saw), which caused the confusion.
Re: Vault – A tool for managing secrets
#8I'm pretty excited about this release. We just added deploying Vault on top of consul in the microservice/realtime data platform we're building:
https://github.com/CiscoCloud/microservices-infrastructure
We were already using consul as our service discovery engine and as a data store for dynamic configurations via consul template. We feel Vault will help us manage secrets on our infrastructure and inside containers.
Re: Vault – A tool for managing secrets
#9[deleted]
Re: Vault – A tool for managing secrets
#10Any reason why AWS dynamic credentials use IAM users instead of STS and role assumption? That seems to be a somewhat more widely accepted way to do dynamic credentials / role proxying.