Hashicorp Vault: Audit log (2)

昨天忘记介绍一个方便的参数，但方便也伴随着安全问题。

问题:

log 都被编码了，怎麽看?

大部分打开audit log都会看到有hmac-sha256的编码，没有办法很直觉的阅读，这是因为预设情况下hmac_accessor = true是开启编码的。

预设编码过的内容:

{
   "time":"2020-08-11T05:55:42.792508611Z",
   "type":"request",
   "auth":{
      "client_token":"hmac-sha256:xxxxxxx5",
      "accessor":"hmac-sha256:xxxxxx9e2951",
      "display_name":"vault",
      "policies":[
         "xxx"
      ],
      "token_policies":[
         "xxxx"
      ],
      "token_type":"service",
      "token_issue_time":"2020-06-05T11:52:43+08:00"
   },
   "request":{
      "id":"a2ex-x-xx-xx324",
      "operation":"read",
      "mount_type":"system",
      "client_token":"hmac-sha256:21xxxxxx41e6d5",
      "client_token_accessor":"hmac-sha256:4ebee3b4614xxxxx9f9e2951",
      "namespace":{
         "id":"xxxx"
      },
      "path":"sys/mounts",
      "remote_address":"10.x.x.x"
   }
}

解决方法

只要将hmac_accessor = false就可以看到明码,不过token,accessor等资讯会直接暴露出来，prd环境建议还是启动比较好。