#hashicorpvault — Public Fediverse posts

Hashicorp Vault TOTP Secrets Engine hỗ trợ tạo và xác thực mã OTP dùng một lần, thời gian sống ngắn (thường 30 giây), phục vụ xác thực hai yếu tố (2FA). Dùng để tích hợp với hệ thống bên ngoài hoặc cung cấp OTP từ Vault. Hỗ trợ API để tạo, liệt kê, xóa khóa và tạo/xác thực mã. Thiết lập dễ dàng qua CLI hoặc GUI.

#HashicorpVault #TOTP #2FA #SecretsEngine #OTP #Vault #Cybersecurity #XacThucHaiYeuTo #MaOTP #BaoMat

https://dev.to/admantium/hashicorp-vault-totp-secrets-engine-1lp3

Envmap - Fini les fichiers .env qui traînent et finissent sur GitHub

https://fed.brid.gy/r/https://korben.info/envmap-secrets-sans-fichier-env-disque-github-leaks.html

Static Kubernetes ServiceAccount tokens are a long-standing security risk.
This post walks through authenticating workloads to HashiCorp Vault using JWT/OIDC, exchanging pod identity for short-lived, least-privilege Vault tokens via a Kubernetes-aware STS—without relying on static credentials.

#Kubernetes #HashiCorpVault #OIDC #WorkloadIdentity #ZeroTrust
https://www.tremolo.io/post/short-lived-tokens-with-vault-without-the-static-serviceaccount

Well, there goes that idea... I had no idea that Kubes had so many certificates/CA roles. Let's Encrypt won't sign sub CA (which makes sense), so I'll have to rely on my CA stack in Vault.

Now I have a new problem... do I split my dns/certs into lab.fqdn.dev and fqdn.local (where the .dev DNS uses Lets Encrypt and the .local uses Vault?)

If so, I'll need to add a new layer to my DNS automation and create a new fqdn.local domain in PowerDNS...

What a fun way to spend Christmas Eve Eve.

#kubernetes #hashicorpvault #certificateauthority #letsencrypt #homelab

More #Homelab things to ponder.

I'm using LetsEncrypt wildcard for my internal network services (this works great by the way... Just don't use .dev as your TLD or you'll be sorry).

I'm on to the LDAP side of things now, and I'm debating if I should use the wild card cert for ldaps. My gut is telling me no, but I'm also kind of lazy and don't know if I want to set up another rig to handle left encrypt renewals.

I also have Hashicorp Vault going. So I suppose I could use that for my CA, but the whole point of using LE is to auto trust things.

#letsencrypt #Vault #hashicorpvault #ldaps