Install Vault by downloading and moving the binary to /usr/local/bin, then verify with vault --version. 2. Create a configuration file with a file backend and TCP listener on 127.0.0.1:8200 with TLS disabled for testing. 3. Initialize Vault using vault operator init, securely store the unseal keys and root token. 4. Unseal Vault with three unseal keys via vault operator unseal. 5. Log in using the root token with vault login. 6. Enable the KV v2 secrets engine at path secret using vault secrets enable kv-v2 -path=secret. 7. Store a secret with vault kv put secret/database password="mysecretpassword" username="dbuser". 8. Retrieve the secret with vault kv get secret/database or get a specific field with vault kv get -field=password secret/database. 9. Create a policy file allowing read access to the database secret. 10. Apply the policy with vault policy write webapp webapp-policy.hcl. 11. Generate a limited token with vault token create -policy=webapp for application use. 12. In production, enable TLS, use secure storage backends like Consul, automate unsealing with cloud KMS, enable audit logging, avoid root tokens, and use AppRole for machine authentication. 13. Set up AppRole with vault auth enable approle, create a role with policies, and retrieve role_id and secret_id. 14. In applications, authenticate to Vault, fetch secrets via API, and cache them securely. 15. Use environment variables only for non-sensitive data, not secrets. Vault ensures secure, auditable, and centralized secret management on Linux servers, making it a best practice to replace plain-text secrets with dynamic, access-controlled ones.

Managing secrets like passwords, API keys, and certificates on a Linux server can quickly become a security risk if done improperly—storing them in config files, environment variables, or version control is a common but dangerous practice. HashiCorp Vault offers a robust solution for securely storing, accessing, and managing secrets. Here’s how to set it up and use it effectively on a Linux server.

Why Use Vault for Secret Management?

Without a dedicated secrets manager, teams often hardcode credentials or store them in plain text, making them vulnerable to leaks. Vault solves this by:

• Encrypting secrets at rest and in transit
• Enforcing access policies and audit logging
• Supporting dynamic secrets (e.g., short-lived database credentials)
• Offering centralized control and revocation

This makes Vault ideal for production environments where security and compliance are critical.

Setting Up Vault on a Linux Server

Start by installing and configuring Vault on your Linux server. Here's a basic setup for development or testing (use production-ready configurations like TLS and HA in real environments).

1. Install Vault

wget https://releases.hashicorp.com/vault/1.15.2/vault_1.15.2_linux_amd64.zip
unzip vault_1.15.2_linux_amd64.zip
sudo mv vault /usr/local/bin/

Verify installation:

vault --version

2. Create a Basic Configuration File

Create /etc/vault.d/vault.hcl:

backend "file" {
  path = "/opt/vault/data"
}

listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = 1
}

api_addr = "http://127.0.0.1:8200"
ui = true

?? In production, enable TLS and bind to a private interface only.

3. Initialize and Start Vault

Create the data directory:

sudo mkdir -p /opt/vault/data

Start Vault:

vault server -config=/etc/vault.d/vault.hcl

In another terminal, initialize Vault:

export VAULT_ADDR=http://127.0.0.1:8200
vault operator init

This outputs 5 unseal keys and an initial root token. Store these securely. You’ll need 3 unseal keys to start Vault after restart.

Unseal Vault:

vault operator unseal
# Run this 3 times with different keys

Log in:

vault login <your-root-token>

Storing and Accessing Secrets

Once Vault is running and unsealed, you can begin using it.

1. Enable the Key-Value Secret Engine

vault secrets enable kv-v2 -path=secret

2. Write a Secret

vault kv put secret/database password="mysecretpassword" username="dbuser"

3. Read a Secret

vault kv get secret/database

You can also retrieve just the password:

vault kv get -field=password secret/database

Avoid printing secrets in scripts. Use them directly in applications via the Vault API.

Secure Access with Policies and Tokens

Giving every app root access is dangerous. Instead, create scoped policies.

1. Create a Policy File (webapp-policy.hcl)

path "secret/data/database" {
  capabilities = ["read"]
}

2. Write and Apply the Policy

vault policy write webapp webapp-policy.hcl

3. Generate a Token with That Policy

vault token create -policy=webapp

Give the generated token to your application. It can now only read the database secret.

Best Practices for Production Use

• ? Always enable TLS – Use a valid certificate and enable tls_cert_file and tls_key_file in the listener config.
• ? Use a secure backend – Replace the file backend with Consul or integrated storage in production.
• ? Automate unsealing – Use auto-unseal with cloud KMS (e.g., AWS KMS, GCP Cloud KMS).
• ? Enable audit logging – Track who accessed what and when:

  vault audit enable file file_path=/var/log/vault-audit.log

• ? Avoid root tokens in apps – Use tokens with minimal required permissions.
• ?? Use AppRole for machine authentication – More secure than static tokens.

Example AppRole setup:

vault auth enable approle
vault write auth/approle/role/webapp policies=webapp
vault read auth/approle/role/webapp/role-id
vault write -f auth/approle/role/webapp/secret-id

Your app can then log in using role_id and secret_id to get a temporary token.

Integrate Vault into Applications

Applications should:

1. Connect to Vault at startup
2. Authenticate (via token, AppRole, etc.)
3. Fetch secrets
4. Cache them securely (with renewal logic if using leases)

For example, in a Python app:

import hvac

client = hvac.Client(url='http://127.0.0.1:8200')
client.token = 'your-app-token'

secret = client.secrets.kv.v2.read_secret_version(path='database')
db_pass = secret['data']['data']['password']

Use environment variables or configuration files only for non-sensitive settings.

Managing secrets securely doesn’t have to be complex. With Vault, you gain strong encryption, access control, and auditing—all essential for modern Linux server environments. Start small, follow best practices, and scale as needed.

Basically, just don’t store secrets in .env files anymore. Vault makes it easy to do it right.

The above is the detailed content of Managing Secrets Securely on a Linux Server with Vault. For more information, please follow other related articles on the PHP Chinese website!