2 ms·
I don't understand the distinction. Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like cre
by falsedan 10y ago
I don't understand the distinction.
Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part).
We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).
- tex0 10y agoI would very much encourage anyone to use Vault to manage secrets consumed by machines, but for personal credentials it's maybe not the best fit.
- endymi0n 10y agoOne of my ideas was using Vault as an alternative backing store for a gopass mount actually. And then it's Vault for company secrets (and no hassle with keys due to central PKI) and gpg for private stores (fast & simple to set up on your own).
- falsedan 10y agoCan you elaborate? (I know why not to use Vault for my banking passwords, also why to use it for the bind password for some app's LDAP auth backend)