Verified Commit aa71c3a6 authored by Xueshan Feng's avatar Xueshan Feng
Browse files

update vault-token-inventory.sh.

parent 9abdae7e

makefile_parts/kube-addons.mk

+1 −1
Original line number Diff line number Diff line
@@ -112,7 +112,7 @@ destroy-heapster: ## Destroy heapster 
## External DNS

###############

.PHONY: external-dns

external-dns: ## Install external-dns

external-dns: config-kube ## Install external-dns

	@if ! helm status external-dns > /dev/null 2>&1; \

	then \

		cat ${TEMPLATES}/external-dns/config.yaml | envsubst | \

vault-token-audit.sh→vault-token-inventory.sh

+27 −17
Original line number Diff line number Diff line 
#!/bin/bash

#!/bin/bash -e 



###############################################################################

# With permission, list current tokens's properties.

# List current tokens's properties using token accessors.

###############################################################################



THIS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"



# include functions

source $THIS_DIR/utils/functions.sh



trap_errors



set +u # optional vars

export VAULT_ADDR=${VAULT_ADDR:-https://vault.stanford.edu}

export VAULT_ADDR=${VAULT_ADDR:-https://127.0.0.1:8200}

export VAULT_SEC_PATH=${VAULT_SEC_PATH:-auth/token/lookup-self}

export VAULT_AUTH_PATH=${VAULT_AUTH_PATH:-ldap}

export VAULT_AUTH_METHOD=${VAULT_AUTH_METHOD:-ldap}

export VAULT_USER=${LOGNAME:-$USER}



set -u

echo "VAULT_ADDR: $VAULT_ADDR"



echo "VAULT ADDR: $VAULT_ADDR"



if ! vault status > /dev/null 2>&1; then

    echo "Cannot check $VAULT_ADDR status. Need to set VAULT_ADDR?"

    exit 1

fi



if ! vault token lookup > /dev/null 2>&1; then

    echo "Hey $VAULT_USER: Please login VAULT with DUO device ready. Waiting...:"
@@ -33,14 +32,25 @@ fi 
if vault token capabilities auth/tokens/accessors | grep -q deny; then

     >&2 "ERROR: no permission to list auth/tokens/accessors" && false

else

    vault list -format=json auth/token/accessors | jq -r '.[]' > /tmp/token-accessors.$$

    vault list -format=json auth/token/accessors | jq -r '.[]' | tee /tmp/token-accessors.$$

    for i in `cat /tmp/token-accessors.$$`

    do

      vault token lookup --format=json --accessor $i | tee -a /tmp/tokens-$$.json

      echo

      echo Look up with token accessor $i

      if ! vault token lookup --format=json --accessor $i 2>/dev/null >> /tmp/token-$$.json; then

        # Get the errors

        echo vault token lookup --format=json --accessor $i

      fi

    done

fi

rm -rf /tmp/token-accessors.$$

echo Token data is saved in /tmp/tokens.$$.json

echo Usefull jq filter

echo "cat /tmp/tokens-$$.json | jq [.data] | jq '.[] | select(.meta.username==\"sfeng\")'"

echo "cat /tmp/tokens-$$.json | jq [.data] | jq '.[] | select(.meta.username==\"sfeng\").policies'"
 
echo Token inventory  is saved in /tmp/token-$$.json



echo Usefull tricks:

echo "cat /tmp/token-$$.json | jq -r [.data] | jq '.[] | select(.meta.username==\"foobar\")'"

echo "cat /tmp/token-$$.json | jq -r [.data] | jq '.[] | select(.meta.username==\"foobar\").policies'"



echo Get all the root info:

echo "cat /tmp/token-$$.json | jq -r '[.data][] | select(.policies[] | contains(\"root\"))'"

echo "cat /tmp/token-$$.json | jq -r '[.data][] | select(.policies[] | contains(\"root\")) | .accessor'"

echo "To revoke a token by accessor: vault token revoke --accessor <accessor>"