Kezdőlap Felfedezés Súgó
Regisztráció Bejelentkezés
AFS
/
infrastructure-notes
2
0
Másolás 0
Fájlok Problémák 0 Beolvasztási kérések 0 Wiki
Fa: b9c6d3b6da
Branch-ok Tag-ek
infrastructure-...
/
MDR Vault Notes.txt

MDR Vault Notes.txt 8.9 KB
Előzmények Nyers

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170 
  1. Vualt is setup with dynamoDB as the backend. Vault has 3 nodes in a cluster and an AWS ALB as the frontend. The vault is unsealed with AWS KMS instead of the usual master key.
    2. 

  2. 

  3. the vault binary is located at /usr/local/bin/vault
    4. 

  4. 

  5. 

  6. 1. change made to the service file
    7. 

  7. Unknown lvalue 'StartLimitIntervalSec' in section 'Service'
    8. 

  8. 

  9. Failed to parse capability in bounding/ambient set, ignoring: CAP_IPC_LOCK,CAP_NET_BIND_SERVICE
    10. 

  10. 

  11. Oct 30 13:31:32 vault-1 systemd: [/etc/systemd/system/vault.service:16] Failed to parse capability in bounding/ambient set, ignoring: CAP_IPC_LOCK,CAP_NET_BIND_SERVICE
    12. 

  12. 

  13. 

  14. 

  15. TEST VAULT
    16. 

  16. 

  17. https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/tree/master/salt/fileroots/vault
    18. 

  18. 

  19. 1. stop vault service from salt on all vault instances
    20. 

  20. 1.1 salt vault* cmd.run 'systemctl stop vault'
    21. 

  21. 2. wipe dynamoDB (select items-> actions -> delete) until there are no more items (BESURE to BACKUP FIRST!)
    22. 

  22. 3. start vault
    23. 

  23. 3.1 run salt state to ensure it is in the correct state with all policies on disk. 
    24. 

  24. 3.2 salt vault* state.sls vault
    25. 

  25. 4. on vault-1, init vault RUN on the server not salt (avoid the recovery keys from getting into logs)
    26. 

  26. 4.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault operator init -tls-skip-verify=true -recovery-shares=5 -recovery-threshold=2
    27. 

  27. 5. login 
    28. 

  28. 5.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault login -tls-skip-verify=true -method=token
    29. 

  29. 5.2 Do yourself a favor and setup some Bash Variables or run commands from salt 
    30. 

  30.     export VAULT_ADDR=https://vault.mdr-test.defpoint.com
    31. 

  31.     export VAULT_ADDR=https://127.0.0.1
    32. 

  32.     export VAULT_ADDR=https://vault.mdr.defpoint.com
    33. 

  33.     export VAULT_SKIP_VERIFY=1
    34. 

  34.     
    35. 

  35. 

  36. 6. setup okta auth
    37. 

  37. 6.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault auth enable okta
    38. 

  38. 6.2 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault write -tls-skip-verify=true auth/okta/config base_url="okta.com" organization="mdr-multipass" token="api_token_here"
    39. 

  39. 6.2 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault write -tls-skip-verify=true auth/okta/config base_url="okta.com" organization="mdr-multipass" token="$( cat ~/.okta-token )"
    40. 

  40. 6.3 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault auth list
    41. 

  41. 6.4 set the TTL for the okta auth method
    42. 

  42. 6.4.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault auth tune -default-lease-ttl=3h -max-lease-ttl=3h okta/
    43. 

  43. 

  44. 

  45. 7. Enable/add Policies
    46. 

  46. 7.1 vault policy write -tls-skip-verify=true admins /etc/vault/admins.hcl
    47. 

  47. 7.2 vault policy write -tls-skip-verify=true engineers /etc/vault/engineers.hcl
    48. 

  48. 7.2 vault policy write -tls-skip-verify=true clu /etc/vault/clu.hcl
    49. 

  49. 7.2 vault policy write -tls-skip-verify=true onboarding /etc/vault/onboarding.hcl
    50. 

  50. 7.2 vault policy write -tls-skip-verify=true portal /etc/vault/portal.hcl
    51. 

  51. 7.2 vault policy write -tls-skip-verify=true soc /etc/vault/soc.hcl
    52. 

  52. 7.2 vault policy write salt-master /etc/vault/salt-master.hcl
    53. 

  53. 7.2 vault policy write saltstack/minions /etc/vault/salt-minions.hcl
    54. 

  54. 

  55. 8 Add external groups
    56. 

  56. 8.1 vault write identity/group name="admins" policies="admins" type="external"
    57. 

  57. 8.2 vault write identity/group name="mdr-engineers" policies="engineers" type="external"
    58. 

  58. 8.3 vault write identity/group name="vault-admins" policies="admins" type="external"
    59. 

  59. 8.4 vault write identity/group name="soc-lead" policies="soc" type="external"
    60. 

  60. 8.5 vault write identity/group name="soc-tier-3" policies="soc" type="external"
    61. 

  61. 

  62. 9 add alias through the GUI. (use the root token to login or a temp root token (better))
    63. 

  63. 9.1 Access -> Groups -> admins -> Aliases -> Create alias -> mdr-admins
    64. 

  64. 9.2 Access -> Groups -> mdr-engineers -> Aliases -> Create alias -> mdr-engineers
    65. 

  65. 9.3 Access -> Groups -> vault-admins -> Aliases -> Create alias -> vault-admin
    66. 

  66. 9.4 Access -> Groups -> soc-lead -> Aliases -> Create alias -> Analyst-Shift-Lead
    67. 

  67. 9.5 Access -> Groups -> soc-tier-3 -> Aliases -> Create alias -> Analyst-Tier-3 
    68. 

  68. 

  69. groups              alias               policy
    70. 

  70. admins              mdr-admins          admins
    71. 

  71. mdr-engineers       mdr-engineers       engineers
    72. 

  72. vault-admins        vault-admin         admins
    73. 

  73. soc-lead            Analyst-Shift-Lead  soc
    74. 

  74. soc-tier-3          Analyst-Tier-3      soc
    75. 

  75. 

  76. 10 enable the file audit 
    77. 

  77. 10.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault audit enable -tls-skip-verify=true file file_path=/var/log/vault.log
    78. 

  78. 

  79. 11 enable the aws & approle auth
    80. 

  80. 11.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault auth enable -tls-skip-verify=true aws
    81. 

  81. 11.2 setup approle auth using the salt-master policy
    82. 

  82. 11.2.1 vault auth enable approle
    83. 

  83. 11.2.2 vault write auth/approle/role/salt-master token_max_ttl=3h token_policies=salt-master
    84. 

  84. 

  85. 12 configure the aws policies on the role (clu and portal) UPDATE THE AWS ACCOUNT!!!
    86. 

  86. 12.1  VAULT_ADDR=https://vault.mdr-test.defpoint.com vault write auth/aws/role/portal auth_type=iam bound_iam_principal_arn=arn:aws:iam::527700175026:role/portal-instance-role policies=portal max_ttl=24h
    87. 

  87. 12.2 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault write auth/aws/role/clu auth_type=iam bound_iam_principal_arn=arn:aws:iam::527700175026:role/clu-instance-role policies=clu max_ttl=24h
    88. 

  88. 

  89. 

  90. 13 Create the kv V2 secret engines
    91. 

  91. VAULT_ADDR=https://vault.mdr-test.defpoint.com ~/Documents/MDR/Vault/vault secrets enable -path=engineering kv-v2
    92. 

  92. vault secrets enable -path=engineering kv-v2
    93. 

  93. vault secrets enable -path=ghe-deploy-keys kv-v2
    94. 

  94. vault secrets enable -path=jenkins kv-v2
    95. 

  95. vault secrets enable -path=onboarding kv-v2
    96. 

  96. vault secrets enable -path=onboarding-afs kv-v2
    97. 

  97. vault secrets enable -path=onboarding-gallery kv-v2
    98. 

  98. vault secrets enable -path=onboarding-saf kv-v2
    99. 

  99. vault secrets enable -path=portal kv-v2
    100. 

  100. vault secrets enable -path=soc kv-v2
    101. 

  101. vault secrets enable -version=1 -path=salt kv 
    102. 

  102. 

  103. vault write salt/pillar_data auth="abc123"
    104. 

  104. 

  105. 

  106. 14 export the secrets (be sure to export your bash variable for VAULT_TOKEN DON'T Use ROOT TOKEN!)
    107. 

  107. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export engineering/data/ -metadata engineering/metadata/ -file engineering-secrets.json -ver 2
    108. 

  108. 

  109. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export ghe-deploy-keys/data/ -metadata ghe-deploy-keys/metadata/ -file ghe-deploy-keys-secrets.json -ver 2
    110. 

  110. 

  111. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export jenkins/data/ -metadata jenkins/metadata/ -file jenkins-secrets.json -ver 2
    112. 

  112. 

  113. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export onboarding/data/ -metadata onboarding/metadata/ -file onboarding-secrets.json -ver 2
    114. 

  114. 

  115. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export onboarding-afs/data/ -metadata onboarding-afs/metadata/ -file onboarding-afs-secrets.json -ver 2
    116. 

  116. 

  117. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export onboarding-gallery/data/ -metadata onboarding-gallery/metadata/ -file onboarding-gallery-secrets.json -ver 2
    118. 

  118. 

  119. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export onboarding-saf/data/ -metadata onboarding-saf/metadata/ -file onboarding-saf-secrets.json -ver 2
    120. 

  120. 

  121. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -export portal/data/ -metadata portal/metadata/ -file portal-secrets.json -ver 2
    122. 

  122. 

  123. 

  124. 15 import the json secret files back into vault
    125. 

  125. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import engineering/ -file engineering-secrets.json -ver 2
    126. 

  126. 

  127. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import ghe-deploy-keys/ -file ghe-deploy-keys-secrets.json -ver 2
    128. 

  128. 

  129. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import jenkins/ -file jenkins-secrets.json -ver 2
    130. 

  130. 

  131. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import onboarding/ -file onboarding-secrets.json -ver 2
    132. 

  132. 

  133. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import onboarding-afs/ -file onboarding-afs-secrets.json -ver 2
    134. 

  134. 

  135. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import onboarding-gallery/ -file onboarding-gallery-secrets.json -ver 2
    136. 

  136. 

  137. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import onboarding-saf/ -file onboarding-saf-secrets.json -ver 2
    138. 

  138. 

  139. /Users/bradpoulton/.go/src/vault-backend-migrator/vault-backend-migrator -import portal/ -file portal-secrets.json -ver 2
    140. 

  140. 

  141. 

  142. 

  143. 

  144. 

  145. 

  146. AWS auth 
    147. 

  147. the vault instances have access to AWS IAM Read. 
    148. 

  148. 

  149. curl -v --header "X-Vault-Token:$VAULT_TOKEN" --request LIST \
    150. 

  150.     https://vault.mdr.defpoint.com:443/v1/auth/aws/roles --insecure
    151. 

  151. 

  152. 

  153. 

  154. 

  155. 

  156. 

  157. 

  158. 8. map okta to policies ( not needed )
    159. 

  159. 8.1 VAULT_ADDR=https://vault.mdr-test.defpoint.com vault policy write -tls-skip-verify=true auth/okta/groups/mdr-admins policies=admins
    160. 

  160. 

  161. 

  162. Vault Logs
    163. 

  163. 

  164. cat 0c86fda6-1139-7914-fef5-6b7532e9fb5a | grep -v -F '"operation":"list"' | grep -v -F '"operation":"read"'
    165. 

  165. cat c3c0b50b-9429-355d-8c8f-038e093c3e4b | grep -v -F '"operation":"list"' | grep -v -F '"operation":"read"'
    166. 

  166. 

  167. entity_34d6c410 -< nothing in logs    
    168. 

  168. "entity_id":"c3c0b50b-9429-355d-8c8f-038e093c3e4b
    169. 

  169. entity_ba27bb07 < - nothing in logs
    170. 

  170. 0c86fda6-1139-7914-fef5-6b7532e9fb5a
    171.