Hashicorp保险柜-仅创建身份验证令牌，请勿读取机密

Question

I'm using Hashicorp Vault: 我正在使用Hashicorp Vault：

I want a user that can create new users, but can't read their secrets. 我想要一个可以创建新用户但无法读取其机密的用户。

Would I just create a policy like: 我是否可以创建一个策略，例如：

path "sys/auth/token/*" {
  policy = "write"
}

since all policies are set to deny? 既然所有政策都设置为拒绝？

Answer 1

This was the incorrect way to use Vault. 这是使用保管箱的错误方法。 These were my errors: 这些是我的错误：

Trying to store user passwords. 尝试存储用户密码。 For me, it looks better to handle platform passwords, like the integrated temporary postgre credentials. 对我来说，处理平台密码看起来更好，例如集成的临时postgre凭证。
Trying to remove any trace of authentication keys on the server. 尝试删除服务器上所有身份验证密钥的痕迹。 If Vault users were going to be created automatically, Vault credentials will need to exist somewhere, either in a script or file with proper permissions. 如果要自动创建Vault用户，则必须在具有适当权限的脚本或文件中将Vault凭据存在于某个位置。
Trying to mitigate a rooted server. 尝试缓解根服务器。 If someone has root access, there are larger problems than that. 如果某人具有root用户访问权限，那么问题就不止于此。 Encryption can mitigate data leaks, like a database dump. 加密可以减轻数据泄漏，例如数据库转储。 Data leaks if root access has been compromised in my case must be accepted. 如果在我的情况下，如果root用户访问受到损害，则数据泄漏必须被接受。 It's best to focus on not getting rooted. 最好专注于不生根。