generate-root command is not an auditable action

[mwielgoszewski]

The generate-root command does not write any entries to the audit log when invoked. Your best chance of capturing this information is by ensuring log-level is set to info on the servers. The following information should be captured upon first and subsequent invocations of the command:

• pgp-key fingerprint
• current progress
• nonce
• hmac-sha256 of the unseal key or the pgp-key fingerprint the unseal key was encrypted to during vault initialization

In some organizations, unseal key holders are not necessarily administrators or even operators of Vault, so knowing who among the unseal key holders performed the operation is pretty important.

[jefferai]

Hi @mwielgoszewski

I don't really follow what you mean by this statement: Your best chance of capturing this information is by ensuring log-level is set to info on the servers. Whose best chance, exactly? What are you seeing in the info log level that you think relevant to this?

Thanks!

[mwielgoszewski]

The only reason I was alerted to an (authorized) invocation of the generate-root command, was because I redirect stdout/stderr to a log file, and the -log-level is set to info. If this command line argument to vault server had been set to warn, I would not have been alerted to this.

[mwielgoszewski]

@jefferai any thoughts on auditing this events via the mounted audit backend log? The only way to know the unseal key holders generated a root token is by capturing log messages sent to stdout/stderr, which is not ideal.

2016/12/27 08:49:46.646618 [INFO ] core: root generation initialized: nonce=1d119aa6-806e-d4e2-0c66-0836228c55bc
2016/12/27 08:51:17.781336 [INFO ] core: root generation finished: nonce=1d119aa6-806e-d4e2-0c66-0836228c55bc

[jefferai]

@mwielgoszewski We have some work done already on a capability that will allow you to know which unseal key holders unsealed Vault (or generated a root token). Once this gets added, I think we will look at also generating audit log messages for these actions. I'm not yet sure if it will be possible for unseal (that may just have to stay in the log) but should be possible for generate-root since that is done against a live Vault server.

I'll add it to the next milestone but may slip depending on when this code gets finished and merged.

[vishalnayak]

This is being tracked in #2244

[jefferai]

Closing in favor of #2244