Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hashicorp-vault]

Questions on the secure configuration of the Vault server and secure design of Vault API clients.

0
votes
1answer
32 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
0
votes
1answer
33 views

If one HashiCorp Vault Policy allows a capability, and another denies it, how does it decide which Policy to honor?

HashiCorp Vault is an open source tool for secrets management. I'm using it for this purpose, and have come across a minor issue. I seemingly cannot deny access to a specific API path. I've tested ...
3
votes
4answers
142 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
1
vote
0answers
50 views

Password protected secrets on Vault

We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS. So far Vault seems to meet most of our current requirements,...
1
vote
1answer
176 views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
0
votes
0answers
101 views

Best practices for automated service authentication with Vault

I'm new to Vault and its patterns but think they're great, having to manually unseal a Vault instance gives some great security. However it seems like those benefits are somewhat reduced by a weak ...
0
votes
1answer
423 views

Store tokens in MySQL or use Vault (HashiCorp)?

I will get thousands of user's tokens when they authorise to us via OAuth (external provider). I am trying to find out what the best practices to securely encrypt user's token into a database. I am ...
3
votes
2answers
1k views

Best practice for securing DB passwords for multiple web apps?

I'm working on upgrading a "legacy" infrastructure where a handful of PHP, Rails and Perl (CGI) applications are in use. Historically, these applications have been written with the database ...
10
votes
1answer
2k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
-3
votes
2answers
447 views

What makes storing secrets in Hashicorp Vault different to using a two-way hash in Java? [closed]

In Java I can create a two way Hash function - if I implemented with MD5 I could write the methods toMD5Hash() and fromMD5Hash for a reversible process. Further than that I could use TripleDes with ...
19
votes
1answer
3k views

Vault: How does AppRole authentication works?

I have a server application (on dynamic infrastructure) which needs to retrieve a secret from Hashicorp Vault during startup. Lets assume we need make this as secure as possible. From the docs and ...
2
votes
1answer
718 views

How can I add a custom domain to an SAN for a certificate for consul domains like active.vault.service.consul?

Say one has a service provided by Consul, for which active.[name-of-service].service.consul is the link it provides to the active host leader for that service. How would I properly set up TLS to that ....
2
votes
1answer
102 views

Is there value to signing microservice calls with an HMAC derived from the same private key?

I had a friend say: We're securing our microservice with an HMAC derived from the private key in the jks file. [Where client and server shared the same private key] I can understand the situation ...
1
vote
1answer
620 views

Distributing private PKI CA Cert with public SSL CA? Any point?

Disclaimer. I'm not even sure if the question is worded correctly in the title. Neither am I sure if I'm asking the right question. If there's literature relevant to this topic, it'd be greatly ...
0
votes
1answer
461 views

What Cipher suites does Hashicorp Vault use?

I've been looking into Hashicorp Vault to use in my linux environment. Ive installed a certificate/private key pair on the Vault Server and told Vault to use TLS. It seems to be working correctly. I ...