Vault file storage
• Mark Eschbach
I’m toying around with the idea of running a Vault server to manage secrets. It’s a kind of cooler more advanced iteration of the scecret storage system I wrote for the interview with Uber I did a while back. They apparently use stuff like this at Ebay too. I’m surprised Hashicorp’s Vault is my first encounter with this kind of store though. Anyway, the unit file was non-trivial and looks something like the following. I used Vivekv’s unit as a base.
[Unit] Description=Vault Dev instances After=network-online.target [Service] PrivateDevices=yes PrivateTmp=yes ProtectSystem=full SecureBits=keep-caps CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK NoNewPrivileges=yes ExecStart=/home/vault/bin/vault server -config=/home/vault/dev.config KillSignal=SIGINT TimeoutStopSec=30s Restart=on-failure StartLimitInterval=60s StartLimitBurst=3 [Install] WantedBy=multi-user.target
Hmm, as I review that I realize I’ve forgotten a few things such as specifying the user and group. The service also complaining it can’t read it’s file back storage on disk. I think I’m more concerned about the user and groups first. Getting distracted by the shiny things: DyanmicUser looks like a really freaking cool option. I’ll have to use that one for network only services. Anyway, I always forget which section
Group go into. Apparently it’s just in the
(In a think southern accent) Well that aint no good. With the user and group specified it just fails to start. No log message at all. Perhaps it’s a user/group issue with the binary? Nope, but wow that is a large binary.
-rwxr-xr-x 1 vault vault 60M Aug 9 09:15 vault
I probably shouldn’t have the binary writtable at all though. Easy fix.
Main process exited, code=exited, status=213/SECUREBITS
Turns out if I read the journal entry it tells me much more. Let’s find out what it means. Well SecureBits in the manual doesn’t mean much to me at this time. The version of SystemD I’m running doesn’t support the
Capabilities attribute, so I’m wondering if that is the root of my problem. All well, it’s my bed time. I’ll have to save this issue for another day.