Create a working Vault server configuration Flashcards
How do you enable command line auto-completion?
vault -autocomplete-install
https://www.vaultproject.io/docs/commands#autocompletion
Where should the Vault process be allowed to write?
The unprivileged Vault service account should not have access to overwrite its executable binary or any Vault configuration files.
Only directories and files for local Vault storage (eg, for the integrated storage backend) or audit logs should be writable by the Vault user.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
Connections to Vault must be encrypted
Where should there be TLS in a Vault infrastructure?
Vault should always be used with TLS in production.
If intermediate load balancers or reverse proxies are used to front Vault, TLS should be used for all network connections between every component of the system (including Storage Backends) to ensure all traffic is encrypted in transit to and from Vault.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
How can you force Vault to use HTTP Strict Transport Security (HSTS)?
HTTP Strict Transport Security (HSTS) header should be set using Vault’s custom response headers feature in the tcp listener.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
How can you prevent Vault from swapping sensitive memory to disk?
Risk of exposure should be minimized by disabling swap to prevent the operating system from paging sensitive data to disk.
This is especially important when using the integrated storage backend.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
How do you prevent a user or administrator that can force a core dump and has access to the resulting file to potentially access Vault encryption keys?
Preventing core dumps is a platform-specific process; on Linux setting the resource limit RLIMIT_CORE to 0 disables core dumps. In the systemd service unit file, setting LimitCORE=0 will enforce this setting for the Vault service.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
Name the various ways to run the Vault process, from most to least secure.
Running on bare metal should be preferred to a VM, and running in a VM should be preferred to running in a container.
In any case, single tenancy is prefered.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
How should incoming and outgoing TCP/UDP traffic to/from Vault be handled?
Use a local firewall or network security features of your cloud provider to restrict incoming and outgoing traffic to Vault and essential system services like NTP. This includes restricting incoming traffic to permitted subnets and outgoing traffic to services Vault needs to connect to, such as databases.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
What should you do with the initial root token?
The initial root token should be used to setup the system initially, particularly setting up auth methods so that users may authenticate.
Once setup, the root token should be revoked to eliminate the risk of exposure. Root tokens can be generated when needed, and should be revoked as soon as possible.
https://learn.hashicorp.com/tutorials/vault/production-hardening#baseline-recommendations
What can you find in Vault’s audit log?
Enabling audit logging provides a history of all operations performed by Vault and a forensics trail in the case of misuse or compromise.
Audit logs securely hash sensitive data, but access should still be restricted to prevent any unintended disclosures.
How do you prevent finding parameters of past vault commands (espescially when using a shared account)?
You may want the vault command itself to not appear in history at all with
export HISTIGNORE=”&:vault*”
https://learn.hashicorp.com/tutorials/vault/static-secrets#option-3-disable-all-vault-command-history
How does Vault uses the current time?
Vault uses the clock for things like enforcing TTLs and setting dates in PKI certificates, and if the nodes have significant clock skew, a failover may wreak havoc.
Use NTP or whatever mechanism is appropriate for your environment to ensure that all the Vault nodes agree about what time it is.
Vault storage is always encrypted, yet it requires special consideration. Which ones and why?
An attacker with arbitrary control can cause data corruption or loss by modifying or deleting keys. Access to the storage backend should be restricted to only Vault to avoid unauthorized access or operations.
What credentials can you find in Vault’s configuration?
The seal stanza of the Vault configuration file configures the seal type to use for additional data protection such as using HSM or Cloud KMS solutions to encrypt and decrypt the master key.
Many cloud-based storage engines also require authentication.
Where should you put Vault’s own credentials, in order from the most secure to the least?
Depending on the seal type and storage strategy, you should use the platform’s built-in authentication, environment variables or store them in the configuration file.
