Lutz Finsterle
21929fa899
Two isolated personal-credential backup options to evaluate, both excluded
from the admin policy (root-only break-glass):
- Scenario A: personal/ KV v2 (versioned) + personal-{put,get,list}.sh
- Scenario B: transit-personal/ key personal-backup + secret-{encrypt,decrypt}.sh
Plus an AppRole example of how a system should consume a secret:
- demo-app role/policy (read-only secret/demo-app/*), short-lived tokens
- scripts/app-get-secret.sh: login (role_id+secret_id) -> token -> read
All tokens/credentials live under ~/.config/openbao (outside the repo).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
1.0 KiB
Bash
Executable File
21 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Scenario B (transit blob): encrypt a file with OpenBAO's transit key
|
|
# `personal-backup`. OpenBAO holds only the KEY; the ciphertext is a portable
|
|
# blob you can store anywhere (Synology, git, offsite). Output is ASCII.
|
|
# secret-encrypt.sh <infile> [outfile] (default outfile: <infile>.vaultenc)
|
|
set -euo pipefail
|
|
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
|
|
TOKF="$HOME/.config/openbao/personal-transit.token"
|
|
KEY="personal-backup"
|
|
in="${1:?usage: secret-encrypt.sh <infile> [outfile]}"; out="${2:-$in.vaultenc}"
|
|
[ -r "$TOKF" ] || { echo "no token at $TOKF" >&2; exit 1; }
|
|
[ -r "$in" ] || { echo "no input file: $in" >&2; exit 1; }
|
|
|
|
ct="$(base64 -w0 "$in" \
|
|
| python3 -c 'import json,sys;print(json.dumps({"plaintext":sys.stdin.read()}))' \
|
|
| curl -sS -H "X-Vault-Token: $(cat "$TOKF")" --data @- "$ADDR/v1/transit-personal/encrypt/$KEY" \
|
|
| jq -r '.data.ciphertext // empty')"
|
|
[ -n "$ct" ] || { echo "encrypt failed" >&2; exit 1; }
|
|
printf '%s\n' "$ct" > "$out"
|
|
echo "encrypted $in -> $out ($(wc -c < "$out") bytes ciphertext)"
|