Production Hashicorp Vault Minimal Configuration On CentOS 7
Published: 2022-09-09 22:30:30

This is a hello world with Hashicorp Vault to get a production server working.

I had looked high and low for a way to configure the simplest possible production Vault server, and I was not able to find anything in which every step worked.

## Assumptions

It is assumed that one has command line access to a CentOS Linux release 7.9.2009 (Core) or equivalent and Vault v1.8.2 (aca76f63357041a43b49f3e8c11d67358496959f) installed.

Ensure that your bash PATH variable includes /usr/local/bin.

## Install Vault

```sh
wget https://releases.hashicorp.com/vault/1.8.2/vault_1.8.2_linux_amd64.zip
unzip vault_1.8.2_linux_amd64.zip
mv vault /usr/local/bin
```

## Install OpenSSL

The version of SSL that is in Centos 7 is too old.

```sh
# CentOS 7 has too old SSL, sigh.

yum -y update

# Install required packages
yum install -y make gcc perl-core pcre-devel wget zlib-devel

# Download the latest version of OpenSSL source code
wget https://ftp.openssl.org/source/openssl-1.1.1k.tar.gz

# Configure, build and install OpenSSL
# Uncompress the source file
tar -xzvf openssl-1.1.1k.tar.gz

# Change to the OpenSSL directory
cd openssl-1.1.1k

# Configure the package for compilation
./config --prefix=/opt/ssl --openssldir=/opt/ssl/etc/ssl --libdir=lib no-shared zlib-dynamic

# Compile package
make -j4

# Install compiled package
sudo make install
```

## Make TLS Certificates

A production Vault server is going to use SSL.

```
IP=`hostname -I | cut -f1 -d" "`

sudo mkdir -p /opt/vault/{tls,data}
# alias openssl=/opt/ssl/bin/openssl

export LD_LIBRARY_PATH=/opt/ssl/lib:$LD_LIBRARY_PATH
cd /opt/vault/tls \
&& sudo rm -f tls.key tls.crt \
&& sudo -E /opt/ssl/bin/openssl req -out tls.crt -new -keyout tls.key -newkey rsa:4096 -nodes -sha256 -x509 -subj "/O=HashiCorp/CN=Vault" \
-addext "subjectAltName = IP:${IP},DNS:${IP}" -days 3650
```

## Configure Vault

Create a file called config.hcl and paste the following. Replace $IP with your IP address you get from "hostname -I".

```hcl
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
}

api_addr = "http://$IP:8200"

storage "file" {
  path = "/opt/vault/data"
}

max_lease_ttl = "10h"
default_lease_ttl = "10h"
ui = true
```
## Run the Vault Server

The moment of truth. When we actually run our vault server. Note, you need to keep this console window open so have a second window for doing the rest of the commands.

```sh
sudo vault server -config=config.hcl
```
## Check Vault Status

First set some variables then check vault status. NOTE: for subsequent commands these bash variables need to be set:

```sh
IP=`hostname -I | cut -f1 -d" "`
export VAULT_ADDR=https://${IP}:8200
export VAULT_CACERT="/opt/vault/tls/tls.crt"
```

The next command checks to see if vault is running, and you can connect to your local vault server.

```
vault status
```
## Unseal Vault and Login

```
vault operator init -key-shares=1 -key-threshold=1
```

This will give you the unseal key. Take note of it.

```
vault operator unseal
```

Now give your unseal key.

```
vault login
```

## Verify Persistent Storage

Ensure that our production server can actually store keys
between server restarts.

Enable secrets backend:

```
vault secrets enable -version=2 -path=kv2 kv
```

Now add a secret:

```
vault kv put kv2/secret username=admin password=qwertyasdf
```

Now list said secret:

```
vault kv get kv2/secret
```

Shut down the server with CTRL-c on the terminal where we are running vault then
restart it.

Now go through unseal steps above.

Finally see if we can print our secret:

```
vault kv get kv2/secret
```