Aller au contenu principal

Vault - Installation

1. Informations​

2. Installation​

$ sudo yum install -y yum-utils
$ sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
  • Installer le paquet vault
$ sudo yum update
$ sudo yum install vault

3. Configuration​

  • Modifier le fichier /etc/vault.d/vault.hcl
ui = true
#mlock = true
#diasble_mlocl = true

# Storage
storage "file" {
  path = "/opt/vault/data"
}

# HTTPS listener
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/etc/pki/tls/certs/vault1.home.lab.pem"
  tls_key_file = "/etc/pki/tls/certs/vault1.home.lab.key"
}

4. Génération d'un certificat​

4.1. Générer un certificat​

$ sudo ipa-getcert request \
  -f /etc/pki/tls/certs/vault1.home.lab.pem \
  -k /etc/pki/tls/private/vault1.home.lab.key \
  -K host/vault1.home.lab \
  -N "CN=vault1.home.lab" \
  -D vault1.home.lab \
  -D vault1

4.2. Changer les permissions du certificat et clé privée​

$ sudo chmod a+r /etc/pki/tls/certs/vault1.home.lab.pem
$ sudo chown root:vault /etc/pki/tls/private/vault1.home.lab.key
$ sudo chmod 640 /etc/pki/tls/private/vault1.home.lab.key

4.3. Récupérer le certificat de l'AC​

$ sudo curl http://ipa1.home.lab/ipa/config/ca.crt -o /etc/pki/ca-trust/source/anchors/ca-homelab.pem
$ sudo update-ca-trust

5. Démarrage du service vault​

  • Démarrer le service vault
$ sudo systemctl enable --now vault
  • Vérifier le statut du service vault
$ systemctl status vault

6. Initialisation de vault​

$ export VAULT_ADDR=https://vault1.home.lab:8200
$ vault operator init

7. Déverrouillage de vault​

$ export VAULT_ADDR=https://vault1.home.lab:8200
$ vault operator unseal