Saltar a contenido

Vault

"Clase de la hoja"

########################################################################################################################################################################################################################################################## Copiar todos los comandos
########################################################################################################################################################################################################################################################## Generar PDF seleccionado/button

■/div titulada

HashiCorp Controles y flujos de trabajo de Vault para la gestión de secretos, cifrado y acceso seguro a datos sensibles.

Instalación

Command Description
vault version Show Vault version
vault server -dev Start development server
vault server -config=config.hcl Start with configuration file
vault status Check server status

Authentication " Login

Autenticación básica

Command Description
vault auth -method=userpass username=myuser Login with username/password
vault auth -method=ldap username=myuser Login with LDAP
vault auth -method=github token=mytoken Login with GitHub
vault auth -method=aws Login with AWS IAM
vault auth -method=kubernetes Login with Kubernetes

Token Management

Command Description
vault token create Create new token
vault token create -ttl=1h Create token with TTL
vault token lookup Look up current token
vault token renew Renew current token
vault token revoke TOKEN Revoke specific token

Secrets Management

Secretos de valor clave (v2)

Command Description
vault kv put secret/myapp username=admin password=secret Store secret
vault kv get secret/myapp Retrieve secret
vault kv get -field=password secret/myapp Get specific field
vault kv delete secret/myapp Delete secret
vault kv list secret/ List secrets
vault kv metadata get secret/myapp Get metadata

Versiones secretas

Command Description
vault kv put secret/myapp @data.json Store from JSON file
vault kv get -version=2 secret/myapp Get specific version
vault kv rollback -version=1 secret/myapp Rollback to version
vault kv destroy -versions=2,3 secret/myapp Destroy versions
vault kv undelete -versions=2 secret/myapp Undelete versions

Base de datos Secrets Engine

Configuración de bases de datos

Command Description
vault secrets enable database Enable database engine
vault write database/config/my-mysql-database plugin_name=mysql-database-plugin connection_url="\\{\\{username\\}\\}:\\{\\{password\\}\\}@tcp(localhost:3306)/" allowed_roles="my-role" username="vaultuser" password="vaultpass" Configure MySQL
vault write database/roles/my-role db_name=my-mysql-database creation_statements="CREATE USER '\\{\\{name\\}\\}'@'%' IDENTIFIED BY '\\{\\{password\\}\\}';GRANT SELECT ON *.* TO '\\{\\{name\\}\\}'@'%';" default_ttl="1h" max_ttl="24h" Create role

Credenciales dinámicos

Command Description
vault read database/creds/my-role Generate database credentials
vault write database/rotate-root/my-mysql-database Rotate root credentials

PKI (Infraestructura de clave pública)

PKI Setup

Command Description
vault secrets enable pki Enable PKI engine
vault secrets tune -max-lease-ttl=87600h pki Set max TTL
vault write pki/root/generate/internal common_name=example.com ttl=87600h Generate root CA
vault write pki/config/urls issuing_certificates="http://vault.example.com:8200/v1/pki/ca" crl_distribution_points="http://vault.example.com:8200/v1/pki/crl" Configure URLs

Gestión de certificados

Command Description
vault write pki/roles/example-dot-com allowed_domains=example.com allow_subdomains=true max_ttl=72h Create role
vault write pki/issue/example-dot-com common_name=test.example.com Issue certificate
vault write pki/revoke serial_number=39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58 Revoke certificate

AWS Secrets Engine

Configuración AWS

Command Description
vault secrets enable aws Enable AWS engine
vault write aws/config/root access_key=AKIAI... secret_key=R4nm... Configure root credentials
vault write aws/roles/my-role credential_type=iam_user policy_document=-<<EOF \\{...\\} EOF Create IAM role

Credenciales de AWS

Command Description
vault read aws/creds/my-role Generate AWS credentials
vault write aws/sts/my-role ttl=15m Generate STS credentials

Transit Secrets Engine

Configuración de cifrado

Command Description
vault secrets enable transit Enable transit engine
vault write transit/keys/my-key type=aes256-gcm96 Create encryption key
vault write transit/encrypt/my-key plaintext=$(base64 <<< "my secret data") Encrypt data
vault write transit/decrypt/my-key ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeDX9vyf7w== Decrypt data

Gestión clave

Command Description
vault write transit/keys/my-key/rotate Rotate encryption key
vault read transit/keys/my-key Read key information
vault write transit/rewrap/my-key ciphertext=vault:v1:... Rewrap with latest key

Políticas

Policy Management

Command Description
vault policy write my-policy policy.hcl Create/update policy
vault policy read my-policy Read policy
vault policy list List all policies
vault policy delete my-policy Delete policy

Ejemplo de política

# Read operation on the k/v secrets
path "secret/data/*" \\\\{
  capabilities = ["read"]
\\\\}

# Write operation on the k/v secrets
path "secret/data/myapp/*" \\\\{
  capabilities = ["create", "update"]
\\\\}

# Deny all access to secret/admin
path "secret/data/admin" \\\\{
  capabilities = ["deny"]
\\\\}

Métodos de Auth

Habilitar métodos Auth

Command Description
vault auth enable userpass Enable username/password
vault auth enable ldap Enable LDAP
vault auth enable github Enable GitHub
vault auth enable aws Enable AWS IAM
vault auth enable kubernetes Enable Kubernetes

Configure Auth Methods

Command Description
vault write auth/userpass/users/myuser password=mypass policies=my-policy Create user
vault write auth/ldap/config url="ldap://ldap.example.com" userdn="ou=Users,dc=example,dc=com" Configure LDAP
vault write auth/github/config organization=myorg Configure GitHub

Auditoría

Activar dispositivos de auditoría

Command Description
vault audit enable file file_path=/vault/logs/audit.log Enable file audit
vault audit enable syslog Enable syslog audit
vault audit list List audit devices
vault audit disable file/ Disable audit device

Alta disponibilidad " Clustering

Operaciones de agrupación

Command Description
vault operator init Initialize Vault cluster
vault operator unseal Unseal Vault
vault operator seal Seal Vault
vault operator step-down Step down as leader
vault operator raft list-peers List Raft peers

Recuperación

Command Description
vault operator raft snapshot save backup.snap Create snapshot
vault operator raft snapshot restore backup.snap Restore snapshot

Ejemplos de configuración

Configuración del servidor

storage "consul" \\\\{
  address = "127.0.0.1:8500"
  path    = "vault/"
\\\\}

listener "tcp" \\\\{
  address     = "0.0.0.0:8200"
  tls_disable = 1
\\\\}

api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
ui = true

Auto-unseal con AWS KMS

seal "awskms" \\\\{
  region     = "us-east-1"
  kms_key_id = "12345678-1234-1234-1234-123456789012"
\\\\}

Medio ambiente

Variable Description
VAULT_ADDR Vault server address
VAULT_TOKEN Authentication token
VAULT_NAMESPACE Vault namespace (Enterprise)
VAULT_CACERT CA certificate file
VAULT_CLIENT_CERT Client certificate file
VAULT_CLIENT_KEY Client private key file

Buenas prácticas

Seguridad

  1. ** Habilitar TLS**: Utilizar siempre TLS en producción
  2. El Privilege Bestia: Conceder permisos mínimos requeridos
  3. Token TTL: Use tokens de corta duración
  4. Audit Logging: Permitir una auditoría completa
  5. Seal/Unseal: Implementar procedimientos adecuados de sellado/sinseal

Operaciones

  1. High Availability: Despliegue en modo HA para la producción
  2. ** Estrategia de respuesta**: instantáneas regulares y copias de seguridad
  3. Monitoring: Supervisar la salud y el rendimiento de Vault
  4. Rotación: llave regular y rotación credencial
  5. Access Patterns: Monitorear y analizar patrones de acceso

Desarrollo

  1. Modo Dev: Usar el modo Dev sólo para el desarrollo
  2. ** Pruebas de política**: Políticas de prueba exhaustivamente
  3. ** Versión secreta**: Usar versión secreta para rollbacks
  4. Integración: Integrar con oleoductos CI/CD
  5. Documentación: documentar caminos y políticas secretos