{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/1446","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/1446/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/1446/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/1446/events","html_url":"https://github.com/hashicorp/vault/issues/1446","id":156631801,"number":1446,"title":"Vault master key remains in process memory after vault is sealed","user":{"login":"Vayu","id":626781,"avatar_url":"https://avatars.githubusercontent.com/u/626781?v=3","gravatar_id":"","url":"https://api.github.com/users/Vayu","html_url":"https://github.com/Vayu","followers_url":"https://api.github.com/users/Vayu/followers","following_url":"https://api.github.com/users/Vayu/following{/other_user}","gists_url":"https://api.github.com/users/Vayu/gists{/gist_id}","starred_url":"https://api.github.com/users/Vayu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Vayu/subscriptions","organizations_url":"https://api.github.com/users/Vayu/orgs","repos_url":"https://api.github.com/users/Vayu/repos","events_url":"https://api.github.com/users/Vayu/events{/privacy}","received_events_url":"https://api.github.com/users/Vayu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-05-24T23:27:46Z","updated_at":"2016-05-25T18:00:00Z","closed_at":null,"body":"I wrote a little script which looks for master key in the process memory https://github.com/Vayu/vault_recover. It seems like vault master key can be extracted even after the vault was sealed. Below is an example shell session on a vault running with file backend created for testing (tested on Linux, probably won't work on OS X):\r\n\r\n```\r\n% vault unseal\r\nKey (will be hidden): \r\nSealed: false\r\nKey Shares: 5\r\nKey Threshold: 3\r\nUnseal Progress: 0\r\n\r\n% sudo vault_recover.py --keyring data/core/_keyring --pid `pgrep vault`                   \r\nINFO:root:Trying pid 24795\r\nINFO:root:Scanning pid 24795 range c81ffd8000-c820500000 [stack:24796];\r\nINFO:root:Found 12 candidate pointers\r\nINFO:root:Key 40555ee300bb7b1d2da2bc8b18390c4206f3890b1de455d964effbf35f5c2a14\r\nINFO:root:Plaintext {\"MasterKey\":\"QFVe4wC7ex0toryLGDkMQgbziQsd5FXZZO/7819cKhQ=\",\"Keys\":[{\"Term\":1,\"Version\":1,\"Value\":\"l0mQe7OqpAvnhyNZoNiYzikZaAWtK90UzP67kyCjN4M=\",\"InstallTime\":\"2016-05-24T10:50:02.839355393+02:00\"}]}\r\n\r\n% vault seal                                                                    \r\nVault is now sealed.\r\n\r\n% sudo vault_recover.py --keyring data/core/_keyring --pid `pgrep vault`\r\nINFO:root:Trying pid 24795\r\nINFO:root:Scanning pid 24795 range c81ffd0000-c820600000 [stack:24796];\r\nINFO:root:Found 6 candidate pointers\r\nINFO:root:Key 40555ee300bb7b1d2da2bc8b18390c4206f3890b1de455d964effbf35f5c2a14\r\nINFO:root:Plaintext {\"MasterKey\":\"QFVe4wC7ex0toryLGDkMQgbziQsd5FXZZO/7819cKhQ=\",\"Keys\":[{\"Term\":1,\"Version\":1,\"Value\":\"l0mQe7OqpAvnhyNZoNiYzikZaAWtK90UzP67kyCjN4M=\",\"InstallTime\":\"2016-05-24T10:50:02.839355393+02:00\"}]}\r\n```"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/221656348","html_url":"https://github.com/hashicorp/vault/issues/1446#issuecomment-221656348","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/1446","id":221656348,"user":{"login":"Vayu","id":626781,"avatar_url":"https://avatars.githubusercontent.com/u/626781?v=3","gravatar_id":"","url":"https://api.github.com/users/Vayu","html_url":"https://github.com/Vayu","followers_url":"https://api.github.com/users/Vayu/followers","following_url":"https://api.github.com/users/Vayu/following{/other_user}","gists_url":"https://api.github.com/users/Vayu/gists{/gist_id}","starred_url":"https://api.github.com/users/Vayu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Vayu/subscriptions","organizations_url":"https://api.github.com/users/Vayu/orgs","repos_url":"https://api.github.com/users/Vayu/repos","events_url":"https://api.github.com/users/Vayu/events{/privacy}","received_events_url":"https://api.github.com/users/Vayu/received_events","type":"User","site_admin":false},"created_at":"2016-05-25T18:00:00Z","updated_at":"2016-05-25T18:00:00Z","body":"One might argue that stressing it could make people quicker realize that single operator with SSH and sudo on the Vault host has effectively the same access privileges as 3+ people holding unseal key parts. And therefore design their procedures and policies with that knowledge in mind.\r\n\r\nCorrect me if I'm wrong, but I don't notice any attempt to zero-out the master key in `barrier_aes_gcm.go`.\r\n```\r\n// Seal is used to re-seal the barrier. This requires the barrier to\r\n// be unsealed again to perform any further operations.\r\nfunc (b *AESGCMBarrier) Seal() error {\r\n\tb.l.Lock()\r\n\tdefer b.l.Unlock()\r\n\r\n\t// Remove the primary key, and seal the vault\r\n\tb.cache = make(map[uint32]cipher.AEAD)\r\n\tb.keyring = nil\r\n\tb.sealed = true\r\n\treturn nil\r\n}\r\n```\r\n\r\nDocumentation which you linked implies that sealing the Vault is a good way to deal with intrusion. What kind of intrusion is assumed here? Maybe add a remote shutdown command?\r\n\r\n>This way, if there is a detected intrusion, the Vault data can be locked quickly to try to minimize damages. It can't be accessed again without access to the master key shards."}}
{"actor":{"display_login":"Vayu"}}