Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vault – A tool for managing secrets

hashicorp.com

Post reply on HN
Print view View original

31–40 of 112 posts

Re: Vault – A tool for managing secrets

#31

Post by nutate »

mitchellh wrote: post #19
jvehent wrote: post #18

There are many solutions out there that attempt to solve the secrets distribution problem. Vault is the newest one. None of them solve the fundamental problem of the secret zero: provisioning the first secret on an untrusted system the automated way is hard, and without that secret zero, there is no way to authenticate the new system. With Vault, you still need to figure out how to push secret zero (here a client aut…

We worked with a handful of companies to help us design the "App ID" authentication backend that does exactly that: https://vaultproject.io/docs/auth/app-id.html It allows you to have a non-sensitive single factor within things like configuration management, and have the second factor come from a machine-local location (instance ID, MAC address, TSM module, etc.). The idea is that another team out of band sets the 2n…

hard problem, but you clearly address it.

There is a typo though: "in client" should probably read "if a client" or "if the client"

Re: Vault – A tool for managing secrets

#33

Post by perlgeek »

It sounds very exciting.

But, the first example made me flinch:

    $ vault write secret/foo value=bar
Don't ever pass passwords on the command line. On linux, other users can see your command line (ps aux), and it usually ends up in a shell's history file.

Re: Vault – A tool for managing secrets

#34

Post by ars »

outworlder wrote: post #29

> "Vault is the sixth such tool we've built. We've also built Vagrant, Packer, Serf, Consul, and Terraform. " Sigh. This is the first time that I actually feel overwhelmed. That nagging feeling that I'm doing something in some way solely because of habits. And that someone somewhere has created an awesome tool that would have allowed me to go home two hours earlier. The amount of new tools cropping in the last couple…

Don't feel that way. Very few tools like this stand the test of time.

I avoid using new tools in production. I wait a few years first to see if they last - after all I'm going to have to support the system for years, I don't want the tools to be the weak spot.

Re: Vault – A tool for managing secrets

#35

Post by odiroot »

perlgeek wrote: post #33

It sounds very exciting. But, the first example made me flinch: $ vault write secret/foo value=bar Don't ever pass passwords on the command line. On linux, other users can see your command line (ps aux), and it usually ends up in a shell's history file.

Put a space before the command and it's gone from the history, AFAIR.

Re: Vault – A tool for managing secrets

#36

Post by mitchellh »

perlgeek wrote: post #33

It sounds very exciting. But, the first example made me flinch: $ vault write secret/foo value=bar Don't ever pass passwords on the command line. On linux, other users can see your command line (ps aux), and it usually ends up in a shell's history file.

Absolutely true! We support values coming from the command-line, stdin, and files: https://vaultproject.io/docs/commands/read-write.html So you should use what you feel is most secure given the data you're entering.

Re: Vault – A tool for managing secrets

#37

Post by odiroot »

mitchellh wrote: post #6
carllerche wrote: post #2

Looks interesting. There is definitely a need for something secure to manage secrets easily & efficiently. I'm not super familiar with Shamir's secret sharing. The post says that the master key is split up across a number of people. One thing that I am confused about is if Vault goes down (possibly in the middle of the night), does it require a quorum of humans to boot it back up?

It does. The solution to this problem is to run Vault in high availability mode[1]. This will have a set of stand-bys that can take over if the leader goes down. The idea is to unseal all the stand bys, and if the leader goes down, the standbys take over, and the sealed one can be unsealed at some other future point. Security-sensitive things have been an interesting UX challenge for us, but this compromise comes at…

Would you also recommend to set the lease duration to something higher in order to allow people to react?

This way even if Vault dies during the night (and you don't have pager duty) at least some clients (e.g. your cloud instances) can live through?

Re: Vault – A tool for managing secrets

#38

Post by ams6110 »

perlgeek wrote: post #33

It sounds very exciting. But, the first example made me flinch: $ vault write secret/foo value=bar Don't ever pass passwords on the command line. On linux, other users can see your command line (ps aux), and it usually ends up in a shell's history file.

How many people these days share their linux machine with anyone else? If you're the only user, first point doesn't matter. History file is a concern, but can be mitigated e.g. setting HISTIGNORE

Re: Vault – A tool for managing secrets

#39

Post by ams6110 »

odiroot wrote: post #35
perlgeek wrote: post #33

It sounds very exciting. But, the first example made me flinch: $ vault write secret/foo value=bar Don't ever pass passwords on the command line. On linux, other users can see your command line (ps aux), and it usually ends up in a shell's history file.

Put a space before the command and it's gone from the history, AFAIR.

Yes but very easy to forget to do. BTDT.
Post reply on HN