๐ Table of Contents
โ Why
HashiCorp Vault provides a few options for auto-unsealing clusters:
- Cloud KMS (AWS, Azure, GCP, and others) (cloud only)
- Hardware Security Modules with PKCS11 (enterprise only)
- Transit Engine via Vault (requires another vault cluster)
- Potentially others
However, depending on your deployment conditions and use-cases of Vault, some of the above may not be feasible (cost, network connectivity, complexity). This may lead you to want to roll your own unseal functionality, however, it's not easy to do in a relatively secure manner.
So, what do we need to solve? We want to auto-unseal a vault cluster, by providing the necessary unseal tokens when we find vault is sealed. We also want to make sure we're sending notifications when this happens, so if vault was unsealed unintentionally (not patching, upgrades, etc), possibly related to crashing or malicious intent, a human can investigate at a later time (not 3am in the morning).
โ๏ธ Solution
The goal for this project is to find the best way to unseal vault in a way that doesn't compromise too much security (a good balance between security and ease of use/uptime), without the requirement of Vault Enterprise, or having to move to a cloud platform.
We do this by running multiple instances of vault-unseal (you could run one on each node in the cluster). Each instance of vault-unseal is given a subset of the unseal tokens. You want to give each node just enough tokens, that when paired with another vault-unseal node, they can work together to unseal the vault. What we want to avoid is giving a single vault-unseal instance enough tokens to unseal (to prevent a compromise leading to enough tokens being exposed that could unseal the vault). Let's use the following example:
Explained further:
cluster-1consists of 3 nodes:node-1node-2node-3
cluster-1is configured with 5 unseal tokens (tokensA,B,C,D,E), but only 3 are required to unseal a given vault node.- given there are 3 nodes, 3 tokens being required:
- vault-unseal on
node-1gets tokensAandB. - vault-unseal on
node-2gets tokensBandC. - vault-unseal on
node-3gets tokensAandC.
- vault-unseal on
With the above configuration:
- Given each vault-unseal node, each node has two tokens.
- Given the tokens provided to vault-unseal, each token (
A,B, andC), there are two instances of that token across nodes in the cluster. - If
node-1is completely hard-offline, nodesnode-2andnode-3should have all three tokens, so if the other two nodes reboot, as long as vault-unseal starts up on those nodes, vault-unseal will be able to unseal both. - If
node-2becomes compromised, and the tokens are read from the config file (note: vault-unseal will not start if the permissions on the file aren't600), this will not be enough tokens to unseal the vault. - vault-unseal runs as root, with root permissions.
๐ป Installation
Check out the releases page for prebuilt versions.
๐ณ Container Images (ghcr)
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:master
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.3.0
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:latest
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.2.4
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.2.3
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.2.2
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.2.1
$ docker run -it --rm ghcr.io/lrstanley/vault-unseal:0.2.0๐งฐ Source
Note that you must have Go installed (latest is usually best).
git clone https://github.com/lrstanley/vault-unseal.git && cd vault-unseal
make
./vault-unseal --help
โ๏ธ Usage
The default configuration path is /etc/vault-unseal.yaml when using deb/rpm.
If you are not using these package formats, copy the example config file,
example.vault-unseal.yaml, to vault-unseal.yaml. Note, all fields can be provided
via environment variables (vault-unseal also supports .env files).
$ ./vault-unseal --help
Usage:
vault-unseal [OPTIONS]
Application Options:
-v, --version Display the version of vault-unseal and exit
-l, --log-path=PATH Optional path to log output to
-c, --config=PATH Path to configuration file (default: ./vault-unseal.yaml)
Help Options:
-h, --help Show this help message
โ๏ธ TODO
- add option to use vault token/another vault instance to obtain keys (e.g. as long the leader is online)?
- memory obfuscating/removing from memory right after unseal?
๐โโ๏ธ Support & Assistance
โค๏ธ Please review the Code of Conduct for guidelines on ensuring everyone has the best experience interacting with the community.๐โโ๏ธ Take a look at the support document on guidelines for tips on how to ask the right questions.๐ For all features/bugs/issues/questions/etc, head over here.
๐ค Contributing
โค๏ธ Please review the Code of Conduct for guidelines on ensuring everyone has the best experience interacting with the community.๐ Please review the contributing doc for submitting issues/a guide on submitting pull requests and helping out.๐๏ธ For anything security related, please review this repositories security policy.
โ๏ธ License
MIT License
Copyright (c) 2018 Liam Stanley <[email protected]>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Also located here