Áú»¢¶Ä²©

2. §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ HashiCorp

§°§Ò§Ù§à§â

§£ §ï§ä§à§Þ §â§Ñ§Ù§Õ§Ö§Ý§Ö §à§Ò§ì§ñ§ã§ß§ñ§Ö§ä§ã§ñ, §Ü§Ñ§Ü §ß§Ñ§ã§ä§â§à§Ú§ä§î Áú»¢¶Ä²© §Õ§Ý§ñ §Ú§Ù§Ó§Ý§Ö§é§Ö§ß§Ú§ñ §ã§Ö§Ü§â§Ö§ä§à§Ó §Ú§Ù HashiCorp Vault KV Secrets Engine - Version 2.

§·§â§Ñ§ß§Ú§Ý§Ú§ë§Ö §Õ§à§Ý§Ø§ß§à §Ò§í§ä§î §â§Ñ§Ù§Ó§×§â§ß§å§ä§à §Ú §ß§Ñ§ã§ä§â§à§Ö§ß§à, §Ü§Ñ§Ü §à§á§Ú§ã§Ñ§ß§à §Ó §à§æ§Ú§è§Ú§Ñ§Ý§î§ß§à§Û .

§¹§ä§à§Ò§í §å§Ù§ß§Ñ§ä§î §à §ß§Ñ§ã§ä§â§à§Û§Ü§Ö TLS §Ó Áú»¢¶Ä²©, §ã§Þ§à§ä§â§Ú§ä§Ö §·§â§Ñ§ß§Ö§ß§Ú§Ö §ã§Ö§Ü§â§Ö§ä§à§Ó.

§ª§Ù§Ó§Ý§Ö§é§Ö§ß§Ú§Ö §å§é§×§ä§ß§í§ç §Õ§Ñ§ß§ß§í§ç §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç

§¹§ä§à§Ò§í §å§ã§á§Ö§ê§ß§à §á§à§Ý§å§é§Ú§ä§î §ã§Ö§Ü§â§Ö§ä §ã §å§é§×§ä§ß§í§Þ§Ú §Õ§Ñ§ß§ß§í§Þ§Ú §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç, §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §à§Ò§Ñ §Þ§Ö§ã§ä§Ñ:

  • Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â/§á§â§à§Ü§ã§Ú
  • §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²©
§³§Ö§â§Ó§Ö§â/§á§â§à§Ü§ã§Ú

§¹§ä§à§Ò§í §ß§Ñ§ã§ä§â§à§Ú§ä§î Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §Ú§Ý§Ú §á§â§à§Ü§ã§Ú, §å§Ü§Ñ§Ø§Ú§ä§Ö §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú:

  • Vault ¡ª §Ü§Ñ§Ü§à§Û §á§à§ã§ä§Ñ§Ó§ë§Ú§Ü §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Õ§à§Ý§Ø§Ö§ß §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ;
  • VaultToken ¡ª §ä§à§Ü§Ö§ß §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ (§á§à§Õ§â§à§Ò§ß§Ö§Ö §ã§Þ§à§ä§â§Ú§ä§Ö §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ/§á§â§à§Ü§ã§Ú);
  • VaultURL ¡ª HTTP[S] URL §ã§Ö§â§Ó§Ö§â§Ñ §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ;
  • VaultDBPath ¡ª §á§å§ä§î §Ü §ã§Ö§Ü§â§Ö§ä§å §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ, §ã§à§Õ§Ö§â§Ø§Ñ§ë§Ö§Þ§å §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç (§ï§ä§Ñ §à§á§è§Ú§ñ §Þ§à§Ø§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ, §ä§à§Ý§î§Ü§à §Ö§ã§Ý§Ú §ß§Ö §å§Ü§Ñ§Ù§Ñ§ß§í DBUser §Ú DBPassword); Áú»¢¶Ä²©-§ã§Ö§â§Ó§Ö§â §Ú§Ý§Ú §á§â§à§Ü§ã§Ú §Ú§Ù§Ó§Ý§Ö§Ü§Ñ§ð§ä §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §á§à §Ü§Ý§ð§é§Ñ§Þ ?password? §Ú ?username?;
  • VaultPrefix ¡ª §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Û §á§â§Ö§æ§Ú§Ü§ã §Õ§Ý§ñ §á§å§ä§Ú §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Ú§Ý§Ú §Ù§Ñ§á§â§à§ã§Ñ §Ó §Ù§Ñ§Ó§Ú§ã§Ú§Þ§à§ã§ä§Ú §à§ä §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ; §Ö§ã§Ý§Ú §ß§Ö §å§Ü§Ñ§Ù§Ñ§ß§à, §Ò§å§Õ§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§à §ß§Ñ§Ú§Ò§à§Ý§Ö§Ö §á§à§Õ§ç§à§Õ§ñ§ë§Ö§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§Ö §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð.

Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §ä§Ñ§Ü§Ø§Ö §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú Vault, VaultToken, VaultURL §Ú VaultPrefix §Õ§Ý§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §á§â§Ú §à§Ò§â§Ñ§Ò§à§ä§Ü§Ö §Þ§Ñ§Ü§â§à§ã§à§Ó §ã§Ö§Ü§â§Ö§ä§Ñ §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ.

Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §Ú Áú»¢¶Ä²© §á§â§à§Ü§ã§Ú §ã§é§Ú§ä§í§Ó§Ñ§ð§ä §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú, §ã§Ó§ñ§Ù§Ñ§ß§ß§í§Ö §ã §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ö§Þ, §Ú§Ù zabbix_server.conf §Ú zabbix_proxy.conf §á§â§Ú §Ù§Ñ§á§å§ã§Ü§Ö. §¬§â§à§Þ§Ö §ä§à§Ô§à, Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §Ú Áú»¢¶Ä²© §á§â§à§Ü§ã§Ú §ã§é§Ú§ä§í§Ó§Ñ§ð§ä §á§Ö§â§Ö§Þ§Ö§ß§ß§å§ð §ã§â§Ö§Õ§í VAULT_TOKEN §à§Õ§ß§à§Ü§â§Ñ§ä§ß§à §Ó§à §Ó§â§Ö§Þ§ñ §Ù§Ñ§á§å§ã§Ü§Ñ §Ú §å§Õ§Ñ§Ý§ñ§ð§ä §Ö§×, §é§ä§à§Ò§í §à§ß§Ñ §ß§Ö §Ò§í§Ý§Ñ §Õ§à§ã§ä§å§á§ß§Ñ §é§Ö§â§Ö§Ù §á§à§â§à§Ø§Õ§Ñ§Ö§Þ§í§Ö (§ï§ä§Ú§Þ§Ú §á§â§à§è§Ö§ã§ã§Ñ§Þ§Ú) §ã§Ü§â§Ú§á§ä§í; §Ò§å§Õ§Ö§ä §à§ê§Ú§Ò§Ü§à§Û, §Ö§ã§Ý§Ú §à§Ò§Ñ §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ VaultToken §Ú VAULT_TOKEN §ã§à§Õ§Ö§â§Ø§Ñ§ä §Ù§ß§Ñ§é§Ö§ß§Ú§Ö.

Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §Ú§Ý§Ú §á§â§à§Ü§ã§Ú §á§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§ð§ä §Ñ§Ó§ä§à§Þ§Ñ§ä§Ú§é§Ö§ã§Ü§à§Ö §á§â§à§Õ§Ý§Ö§ß§Ú§Ö §ã§Ö§â§Ó§Ú§ã§ß§í§ç §ä§à§Ü§Ö§ß§à§Ó §Ú §á§Ö§â§Ú§à§Õ§Ú§é§Ö§ã§Ü§Ú§ç §ã§Ö§â§Ó§Ú§ã§ß§í§ç §ä§à§Ü§Ö§ß§à§Ó. §¦§ã§Ý§Ú Áú»¢¶Ä²© §à§Ò§ß§Ñ§â§å§Ø§Ú§Ó§Ñ§Ö§ä, §é§ä§à §ä§à§Ü§Ö§ß §Ó§à§Ù§à§Ò§ß§à§Ó§Ý§ñ§Ö§Þ§í§Û, §à§ß §Ò§å§Õ§Ö§ä §Ñ§Ó§ä§à§Þ§Ñ§ä§Ú§é§Ö§ã§Ü§Ú §á§â§à§Õ§Ý§Ö§Ó§Ñ§ä§î §Ö§Ô§à §Õ§à §ä§Ö§ç §á§à§â, §á§à§Ü§Ñ §ß§Ö §Ò§å§Õ§Ö§ä §Õ§à§ã§ä§Ú§Ô§ß§å§ä §Þ§Ñ§Ü§ã§Ú§Þ§Ñ§Ý§î§ß§í§Û TTL §ä§à§Ü§Ö§ß§Ñ §Ú§Ý§Ú, §Ó §ã§Ý§å§é§Ñ§Ö §á§Ö§â§Ú§à§Õ§Ú§é§Ö§ã§Ü§Ú§ç §ã§Ö§â§Ó§Ú§ã§ß§í§ç §ä§à§Ü§Ö§ß§à§Ó, §Ò§Ö§ã§Ü§à§ß§Ö§é§ß§à.

§±§â§Ú§Þ§Ö§â

  1. §£ zabbix_server.conf §å§Ü§Ñ§Ø§Ú§ä§Ö §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í:
Vault=HashiCorp
       VaultToken=hvs.CAESIIG_PILmULFYOsEyWHxkZ2mF2a8VPKNLE8eHqd4autYGGh4KHGh2cy5aeTY0NFNSaUp3ZnpWbDF1RUNjUkNTZEg
       VaultURL=https://127.0.0.1:8200
       VaultDBPath=database
       VaultPrefix=/v1/secret/data/zabbix/
  1. §£§í§á§à§Ý§ß§Ú§ä§Ö §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §Ü§à§Þ§Ñ§ß§Õ§í CLI, §é§ä§à§Ò§í §ã§à§Ù§Õ§Ñ§ä§î §ä§â§Ö§Ò§å§Ö§Þ§í§Û §ã§Ö§Ü§â§Ö§ä §Ó §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ö:
# §£§Ü§Ý§ð§é§Ú§ä§Ö §ä§à§é§Ü§å §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ?secret/?, §Ö§ã§Ý§Ú §à§ß§Ñ §Ö§ë§Ö §ß§Ö §Ó§Ü§Ý§ð§é§Ö§ß§Ñ; §à§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §ß§å§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î ?kv-v2?.
       vault secrets enable -path=secret/ kv-v2
       
       # §±§à§Þ§Ö§ã§ä§Ú§ä§Ö §ß§à§Ó§í§Ö §ã§Ö§Ü§â§Ö§ä§í §ã §Ü§Ý§ð§é§Ñ§Þ§Ú username §Ú password §á§à§Õ §ä§à§é§Ü§à§Û §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ?secret/? §Ú §á§å§ä§×§Þ ?secret/zabbix/database?.
       vault kv put -mount=secret zabbix/database username=zabbix password=<§á§Ñ§â§à§Ý§î>
       
       # §±§â§à§Ó§Ö§â§î§ä§Ö, §é§ä§à §ã§Ö§Ü§â§Ö§ä §å§ã§á§Ö§ê§ß§à §Õ§à§Ò§Ñ§Ó§Ý§Ö§ß.
       vault kv get secret/zabbix/database
       
       # §¯§Ñ§Ü§à§ß§Ö§è, §á§â§à§Ó§Ö§â§î§ä§Ö §ã §á§à§Þ§à§ë§î§ð Curl; §à§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §Ó§â§å§é§ß§å§ð §Õ§à§Ò§Ñ§Ó§Ú§ä§î ?data? §á§à§ã§Ý§Ö §ä§à§é§Ü§Ú §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ §Ú ?/v1? §á§Ö§â§Ö§Õ §ä§à§é§Ü§à§Û §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ, §ä§Ñ§Ü§Ø§Ö §ã§Þ§à§ä§â§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â --capath.
       curl --header "X-Vault-Token: <VaultToken>" https://127.0.0.1:8200/v1/secret/data/zabbix/database
  1. §£ §â§Ö§Ù§å§Ý§î§ä§Ñ§ä§Ö Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â §á§à§Ý§å§é§Ú§ä §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §Õ§Ý§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç:
  • §ª§Þ§ñ §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ: zabbix
  • §±§Ñ§â§à§Ý§î: <§á§Ñ§â§à§Ý§î>
§£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã

§£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²© §Þ§à§Ø§ß§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §Õ§Ý§ñ §á§à§Ý§å§é§Ö§ß§Ú§ñ §å§é§×§ä§ß§í§ç §Õ§Ñ§ß§ß§í§ç §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Ú§Ù §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Ý§Ú§Ò§à §Ó§à §Ó§â§Ö§Þ§ñ §å§ã§ä§Ñ§ß§à§Ó§Ü§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ, §Ý§Ú§Ò§à §á§å§ä§×§Þ §à§Ò§ß§à§Ó§Ý§Ö§ß§Ú§ñ §æ§Ñ§Û§Ý§Ñ §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ (zabbix.conf.php).

§¦§ã§Ý§Ú §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Ò§í§Ý§Ú §Ú§Ù§Þ§Ö§ß§Ö§ß§í §ã §Þ§à§Þ§Ö§ß§ä§Ñ §á§â§Ö§Õ§í§Õ§å§ë§Ö§Û §å§ã§ä§Ñ§ß§à§Ó§Ü§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ, §á§Ö§â§Ö§Ù§Ñ§á§å§ã§ä§Ú§ä§Ö §å§ã§ä§Ñ§ß§à§Ó§Ü§å §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ §Ú§Ý§Ú §à§Ò§ß§à§Ó§Ú§ä§Ö zabbix.conf.php. §³§Þ§à§ä§â§Ú§ä§Ö §ä§Ñ§Ü§Ø§Ö: §°§Ò§ß§à§Ó§Ý§Ö§ß§Ú§Ö §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§Ö§Û §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú.

§£§à §Ó§â§Ö§Þ§ñ §å§ã§ä§Ñ§ß§à§Ó§Ü§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Õ§à§Ý§Ø§ß§í §Ò§í§ä§î §å§Ü§Ñ§Ù§Ñ§ß§í §ß§Ñ §ê§Ñ§Ô§Ö §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §ã §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç (Configure DB Connection):

  • §µ§ã§ä§Ñ§ß§à§Ó§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â §·§â§Ñ§ß§Ú§ä§î §å§é§Ö§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §Ó (Store credentials in) §Ó §Ù§ß§Ñ§é§Ö§ß§Ú§Ö ?HashiCorp Vault?.
  • §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ:
§±§Ñ§â§Ñ§Þ§Ö§ä§â §°§Ò§ñ§Ù§Ñ§ä§Ö§Ý§î§ß§í§Û §©§ß§Ñ§é§Ö§ß§Ú§Ö §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §°§á§Ú§ã§Ñ§ß§Ú§Ö
API endpoint §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ
(Vault API endpoint)
§Õ§Ñ https://localhost:8200 §µ§Ü§Ñ§Ø§Ú§ä§Ö URL §Õ§Ý§ñ §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §ç§â§Ñ§ß§Ú§Ý§Ú§ë§å §Ó §æ§à§â§Þ§Ñ§ä§Ö §ã§ç§Ö§Þ§Ñ://§ç§à§ã§ä:§á§à§â§ä
§±§â§Ö§æ§Ú§Ü§ã §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ
(Vault prefix)
§ß§Ö§ä /v1/secret/data/ §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Û §á§â§Ö§æ§Ú§Ü§ã §Õ§Ý§ñ §á§å§ä§Ú §Ú§Ý§Ú §Ù§Ñ§á§â§à§ã§Ñ §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ. §¦§ã§Ý§Ú §ß§Ö §å§Ü§Ñ§Ù§Ñ§ß§à, §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§ã§ñ §Ù§ß§Ñ§é§Ö§ß§Ú§Ö §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð.
§±§â§Ú§Þ§Ö§â: /v1/secret/data/zabbix/
§±§å§ä§î §Ü §ã§Ö§Ü§â§Ö§ä§å §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ
(Vault secret path)
§ß§Ö§ä §±§å§ä§î §Ü §ã§Ö§Ü§â§Ö§ä§å, §Ú§Ù §Ü§à§ä§à§â§à§Ô§à §Ò§å§Õ§å§ä §Ú§Ù§Ó§Ý§Ö§é§Ö§ß§í §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §Õ§Ý§ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §á§à §Ü§Ý§ð§é§Ñ§Þ ?password? §Ú ?username?.
§±§â§Ú§Þ§Ö§â: database
§´§à§Ü§Ö§ß §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ
(Vault authentication token)
§ß§Ö§ä §±§â§Ö§Õ§à§ã§ä§Ñ§Ó§î§ä§Ö §ä§à§Ü§Ö§ß §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Õ§Ý§ñ §Õ§à§ã§ä§å§á§Ñ §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §é§ä§Ö§ß§Ú§ñ §Ü §ã§Ö§Ü§â§Ö§ä§ß§à§Þ§å §á§å§ä§Ú.
§³§Þ§à§ä§â§Ú§ä§Ö §Õ§Ý§ñ §á§à§Ý§å§é§Ö§ß§Ú§ñ §Ú§ß§æ§à§â§Þ§Ñ§è§Ú§Ú §à §ã§à§Ù§Õ§Ñ§ß§Ú§Ú §ä§à§Ü§Ö§ß§à§Ó §Ú §á§à§Ý§Ú§ä§Ú§Ü §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ.

§ª§Ù§Ó§Ý§Ö§é§Ö§ß§Ú§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§Û §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§ç §Þ§Ñ§Ü§â§à§ã§à§Ó

§¹§ä§à§Ò§í §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î HashiCorp Vault §Õ§Ý§ñ §ç§â§Ñ§ß§Ö§ß§Ú§ñ §Ù§ß§Ñ§é§Ö§ß§Ú§Û §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§ç §Þ§Ñ§Ü§â§à§ã§à§Ó §³§Ö§Ü§â§Ö§ä §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ, §å§Ò§Ö§Õ§Ú§ä§Ö§ã§î, §é§ä§à:

§¥§à§ã§ä§å§á §Ü §Ù§ß§Ñ§é§Ö§ß§Ú§ñ§Þ §Þ§Ñ§Ü§â§à§ã§à§Ó §³§Ö§Ü§â§Ö§ä §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Ú§Ù §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §ä§â§Ö§Ò§å§Ö§ä§ã§ñ §ä§à§Ý§î§Ü§à §ã§Ö§â§Ó§Ö§â§å Áú»¢¶Ä²©. §¥§â§å§Ô§Ú§Þ §Ü§à§Þ§á§à§ß§Ö§ß§ä§Ñ§Þ Áú»¢¶Ä²© (§á§â§à§Ü§ã§Ú, §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã) §ä§Ñ§Ü§à§Û §Õ§à§ã§ä§å§á §ß§Ö §ß§å§Ø§Ö§ß.

§©§ß§Ñ§é§Ö§ß§Ú§Ö §Þ§Ñ§Ü§â§à§ã§Ñ §Õ§à§Ý§Ø§ß§à §ã§à§Õ§Ö§â§Ø§Ñ§ä§î §ã§ã§í§Ý§à§é§ß§í§Û §á§å§ä§î (§Ó §Ó§Ú§Õ§Ö §á§å§ä§î:§Ü§Ý§ð§é, §ß§Ñ§á§â§Ú§Þ§Ö§â: macros:password). §´§à§Ü§Ö§ß §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Û §Ó§à §Ó§â§Ö§Þ§ñ §ß§Ñ§ã§ä§â§à§Û§Ü§Ú Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ (§á§Ñ§â§Ñ§Þ§Ö§ä§â§à§Þ VaultToken), §Õ§à§Ý§Ø§Ö§ß §á§â§Ö§Õ§à§ã§ä§Ñ§Ó§Ý§ñ§ä§î §Õ§à§ã§ä§å§á §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §é§ä§Ö§ß§Ú§ñ §Ü §ï§ä§à§Þ§å §á§å§ä§Ú.

§±§à§Õ§â§à§Ò§ß§å§ð §Ú§ß§æ§à§â§Þ§Ñ§è§Ú§ð §à§Ò §à§Ò§â§Ñ§Ò§à§ä§Ü§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§Û §Þ§Ñ§Ü§â§à§ã§à§Ó Áú»¢¶Ä²© §ã§Þ§à§ä§â§Ú§ä§Ö §Ó §Þ§Ñ§Ü§â§à§ã§Ñ§ç §ã§Ö§Ü§â§Ö§ä§Ñ §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ.

§³§Ú§ß§ä§Ñ§Ü§ã§Ú§ã §á§å§ä§Ú

§±§â§ñ§Þ§Ñ§ñ §Ü§à§ã§Ñ§ñ §é§Ö§â§ä§Ñ (?/?) §Ú §Õ§Ó§à§Ö§ä§à§é§Ú§Ö (?:?) §ñ§Ó§Ý§ñ§ð§ä§ã§ñ §Ù§Ñ§â§Ö§Ù§Ö§â§Ó§Ú§â§à§Ó§Ñ§ß§ß§í§Þ§Ú §ã§Ú§Þ§Ó§à§Ý§Ñ§Þ§Ú.

§±§â§ñ§Þ§Ñ§ñ §Ü§à§ã§Ñ§ñ §é§Ö§â§ä§Ñ §Þ§à§Ø§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §à§ä§Õ§Ö§Ý§Ö§ß§Ú§ñ §ä§à§é§Ü§Ú §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ §à§ä §á§å§ä§Ú (§ß§Ñ§á§â§Ú§Þ§Ö§â, secret/zabbix, §Ô§Õ§Ö §ä§à§é§Ü§Ñ §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ¡ª ?secret?, §Ñ §á§å§ä§î ¡ª ?zabbix?). §£ §ã§Ý§å§é§Ñ§Ö §Þ§Ñ§Ü§â§à§ã§à§Ó §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ §Õ§Ó§à§Ö§ä§à§é§Ú§Ö §Þ§à§Ø§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §à§ä§Õ§Ö§Ý§Ö§ß§Ú§ñ §á§å§ä§Ú/§Ù§Ñ§á§â§à§ã§Ñ §à§ä §Ü§Ý§ð§é§Ñ.

§®§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î URL-§Ü§à§Õ§Ú§â§à§Ó§Ñ§ß§Ú§Ö §ã§Ú§Þ§Ó§à§Ý§à§Ó §Ü§à§ã§à§Û §é§Ö§â§ä§í §Ú §Õ§Ó§à§Ö§ä§à§é§Ú§ñ, §Ö§ã§Ý§Ú §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §ã§à§Ù§Õ§Ñ§ä§î §ä§à§é§Ü§å §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ §ã §Ú§Þ§Ö§ß§Ö§Þ, §â§Ñ§Ù§Õ§Ö§Ý§×§ß§ß§í§Þ §Ü§à§ã§à§Û §é§Ö§â§ä§à§Û (§ß§Ñ§á§â§Ú§Þ§Ö§â, foo/bar/zabbix, §Ô§Õ§Ö §ä§à§é§Ü§Ñ §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ¡ª ?foo/bar?, §Ñ §á§å§ä§î ¡ª ?zabbix?, §Þ§à§Ø§ß§à §Ù§Ñ§Ü§à§Õ§Ú§â§à§Ó§Ñ§ä§î §Ü§Ñ§Ü ?foo%2Fbar/zabbix?), §Ú §Ö§ã§Ý§Ú §Ú§Þ§ñ §Ú§Ý§Ú §á§å§ä§î §ä§à§é§Ü§Ú §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ §Õ§à§Ý§Ø§ß§í §ã§à§Õ§Ö§â§Ø§Ñ§ä§î §Õ§Ó§à§Ö§ä§à§é§Ú§Ö.

§±§â§Ú§Þ§Ö§â

  1. §£ Áú»¢¶Ä²© §Õ§à§Ò§Ñ§Ó§î§ä§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Û §Þ§Ñ§Ü§â§à§ã {$PASSWORD} §ã §ä§Ú§á§à§Þ ?§³§Ö§Ü§â§Ö§ä §·§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ? §Ú §ã§à §Ù§ß§Ñ§é§Ö§ß§Ú§Ö§Þ macros:password

  1. §£§í§á§à§Ý§ß§Ú§ä§Ö §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §Ü§à§Þ§Ñ§ß§Õ§í CLI, §é§ä§à§Ò§í §ã§à§Ù§Õ§Ñ§ä§î §ä§â§Ö§Ò§å§Ö§Þ§í§Û §ã§Ö§Ü§â§Ö§ä §Ó §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ö:
# §£§Ü§Ý§ð§é§Ú§ä§Ö §ä§à§é§Ü§å §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ?secret/?, §Ö§ã§Ý§Ú §à§ß§Ñ §Ö§ë§Ö §ß§Ö §Ó§Ü§Ý§ð§é§Ö§ß§Ñ; §à§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §ß§å§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î ?kv-v2?.
       vault secrets enable -path=secret/ kv-v2
       
       # §±§à§Þ§Ö§ã§ä§Ú§ä§Ö §ß§à§Ó§í§Û §ã§Ö§Ü§â§Ö§ä §ã §Ü§Ý§ð§é§à§Þ password §á§à§Õ §ä§à§é§Ü§à§Û §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ ?secret/? §Ú §á§å§ä§×§Þ ?secret/zabbix?.
       vault kv put -mount=secret zabbix/macros password=<§á§Ñ§â§à§Ý§î>
       
       # §±§â§à§Ó§Ö§â§î§ä§Ö, §é§ä§à §ã§Ö§Ü§â§Ö§ä §å§ã§á§Ö§ê§ß§à §Õ§à§Ò§Ñ§Ó§Ý§Ö§ß.
       vault kv get secret/zabbix/macros
       
       # §¯§Ñ§Ü§à§ß§Ö§è, §á§â§à§Ó§Ö§â§î§ä§Ö §ã §á§à§Þ§à§ë§î§ð Curl, §à§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §Õ§à§Ò§Ñ§Ó§Ú§ä§î §Ó§â§å§é§ß§å§ð ?data? §á§à§ã§Ý§Ö §ä§à§é§Ü§Ú §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ §Ú ?/v1? §á§Ö§â§Ö§Õ §ä§à§é§Ü§à§Û §Þ§à§ß§ä§Ú§â§à§Ó§Ñ§ß§Ú§ñ, §ä§Ñ§Ü§Ø§Ö §ã§Þ§à§ä§â§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â --capath.
       curl --header "X-Vault-Token: <VaultToken>" https://127.0.0.1:8200/v1/secret/data/zabbix/macros
  1. §£ §â§Ö§Ù§å§Ý§î§ä§Ñ§ä§Ö Áú»¢¶Ä²© §â§Ñ§ã§Ü§â§à§Ö§ä §Þ§Ñ§Ü§â§à§ã {$PASSWORD} §Ó §Ù§ß§Ñ§é§Ö§ß§Ú§Ö: <§á§Ñ§â§à§Ý§î>

§°§Ò§ß§à§Ó§Ý§Ö§ß§Ú§Ö §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§Ö§Û §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú

§¹§ä§à§Ò§í §à§Ò§ß§à§Ó§Ú§ä§î §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§å§ð §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§ð §Õ§Ý§ñ §Ú§Ù§Ó§Ý§Ö§é§Ö§ß§Ú§ñ §ã§Ö§Ü§â§Ö§ä§à§Ó §Ú§Ù §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ HashiCorp:

  1. §°§Ò§ß§à§Ó§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §æ§Ñ§Û§Ý§Ñ §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §ã§Ö§â§Ó§Ö§â§Ñ Áú»¢¶Ä²© §Ú§Ý§Ú §á§â§à§Ü§ã§Ú, §Ü§Ñ§Ü §à§á§Ú§ã§Ñ§ß§à §Ó §â§Ñ§Ù§Õ§Ö§Ý§Ö §µ§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç.

  2. §°§Ò§ß§à§Ó§Ú§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §¢§¥, §á§Ö§â§Ö§ß§Ñ§ã§ä§â§à§Ú§Ó §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²© §Ú §å§Ü§Ñ§Ù§Ñ§Ó §ä§â§Ö§Ò§å§Ö§Þ§í§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í, §Ü§Ñ§Ü §à§á§Ú§ã§Ñ§ß§à §Ó §â§Ñ§Ù§Õ§Ö§Ý§Ö §£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã. §¹§ä§à§Ò§í §á§Ö§â§Ö§ß§Ñ§ã§ä§â§à§Ú§ä§î §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²©, §à§ä§Ü§â§à§Û§ä§Ö URL-§Ñ§Õ§â§Ö§ã §ß§Ñ§ã§ä§â§à§Û§Ü§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ §Ó §Ò§â§Ñ§å§Ù§Ö§â§Ö:

  • §Õ§Ý§ñ Apache: http://<ip_§Ú§Ý§Ú_§Ú§Þ§ñ_§ã§Ö§â§Ó§Ö§â§Ñ>/zabbix/setup.php
  • §Õ§Ý§ñ Nginx: http://<ip_§Ú§Ý§Ú_§Ú§Þ§ñ_§ã§Ö§â§Ó§Ö§â§Ñ>/setup.php

§¬§â§à§Þ§Ö §ä§à§Ô§à, §ï§ä§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Þ§à§Ø§ß§à §Ù§Ñ§Õ§Ñ§ä§î §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ (zabbix.conf.php):

$DB['VAULT']                    = 'HashiCorp';
       $DB['VAULT_URL']                = 'https://localhost:8200';
       $DB['VAULT_DB_PATH']            = 'database';
       $DB['VAULT_TOKEN']              = '&±ô³Ù;§Þ§à§Û³å§ä§à§Ü§Ö§ß&²µ³Ù;';
       $DB['VAULT_CERT_FILE']          = '';
       $DB['VAULT_KEY_FILE']           = '';
       $DB['VAULT_PREFIX']             = '/v1/secret/data/zabbix/';
  1. §¯§Ñ§ã§ä§â§à§Û§ä§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Ö §Þ§Ñ§Ü§â§à§ã§í, §Ü§Ñ§Ü §à§á§Ú§ã§Ñ§ß§à §Ó §â§Ñ§Ù§Õ§Ö§Ý§Ö §©§ß§Ñ§é§Ö§ß§Ú§ñ §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§ç §Þ§Ñ§Ü§â§à§ã§à§Ó, §Ö§ã§Ý§Ú §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à.

§¹§ä§à§Ò§í §à§Ò§ß§à§Ó§Ú§ä§î §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§å§ð §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§ð §Õ§Ý§ñ §Ú§Ù§Ó§Ý§Ö§é§Ö§ß§Ú§ñ §ã§Ö§Ü§â§Ö§ä§à§Ó §Ú§Ù §ç§â§Ñ§ß§Ú§Ý§Ú§ë§Ñ CyberArk, §ã§Þ§à§ä§â§Ú§ä§Ö §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ CyberArk.