🚀 𝐒𝐞𝐜𝐮𝐫𝐞𝐥𝐲 𝐒𝐭𝐨𝐫𝐢𝐧𝐠 𝐌𝐲𝐒𝐐𝐋 𝐂𝐫𝐞𝐝𝐞𝐧𝐭𝐢𝐚𝐥𝐬 𝐰𝐢𝐭𝐡 𝐇𝐚𝐬𝐡𝐢𝐂𝐨𝐫𝐩 𝐕𝐚𝐮𝐥𝐭: 𝐀 𝐒𝐭𝐞𝐩-𝐛𝐲-𝐒𝐭𝐞𝐩 𝐆𝐮𝐢𝐝𝐞 𝐭𝐨 𝐏𝐚𝐬𝐬𝐢𝐧𝐠 𝐂𝐫𝐞𝐝𝐞𝐧𝐭𝐢𝐚𝐥𝐬 𝐭𝐨 𝐖𝐨𝐫𝐝𝐏𝐫𝐞𝐬𝐬 📌

Are you concerned about the security of your MySQL credentials for your WordPress site? Look no further than the HashiCorp Vault. This powerful tool allows you to securely store and manage your MySQL credentials, while also providing an easy way to pass those credentials to your WordPress site. In this article, we will guide you through the step-by-step process of using HashiCorp Vault to store your MySQL credentials and securely pass them to your WordPress site, so you can rest easy knowing your sensitive data is protected.

Securing your MySQL credentials with HashiCorp Vault is a best practice to protect sensitive information. Vault provides an easy-to-use interface to manage secrets, which can be used to store and retrieve MySQL credentials securely. Here are the steps to store MySQL credentials in HashiCorp Vault:

Enable KV Secrets Engine ( This is the KV version 1)

Vault Secrets Enable

In order to use Vault to store and manage secrets, you first need to enable a secrets engine. The vault secrets enable the command is used to enable a secrets engine in Vault.

The kv secrets engine is a built-in secrets engine in Vault that allows you to store and manage key-value pairs. To enable the kv secrets engine, you can use the vault secrets enable command with the -path option to specify the mount point for the engine.

For example, the following command enables the kv secrets engine at the secret path:

vault secrets enable -path=secret kv

This command tells Vault to enable the kv secrets engine and mount it on the secret path. Once the kv secrets engine is enabled at the secret path, you can use the vault kv commands to manage secrets in Vault.

By enabling the kv secrets engine at the secret path, you can securely store and manage key-value pairs in Vault. This provides a centralized and secure way to manage secrets for your applications and services.

Vault KV Put

The vault kv put the command is used to store a key-value pair in a secrets engine enabled in Vault. In this case, the command is being used to store the username and password for a MySQL database in Vault.

The secret the engine has been enabled at the secret path, and the databases/mysql the path has been created under it to store secrets related to MySQL databases.

The vault kv put the command has the following syntax:

vault kv put <path> <key>=<value> [<key2>=<value2> ...]

In this case, the command is being used to store the username and password for a MySQL database in the secret/databases/mysql path. The command takes the following form:

vault kv put secret/databases/mysql username=wordpressuser password=pass#W3rd

This command will store the username wordpressuser and password pass#W3rd as key-value pairs in the secret/databases/mysql path in Vault.

By storing the username and password for the MySQL database in Vault, you can securely manage and retrieve them as needed. This provides a centralized and secure way to manage database credentials for your applications and services, without having to store them in plaintext or code.

To verify the secrets are created correctly

NOTE: In this scenario, I’m using the KV method from version 1. I’m displaying KV Version 2 for educational purposes as well.

Enable KV Secrets Engine ( This is the KV version 2)

To enable the KV Secrets Engine for Vault:

1. Run the command vault secrets enable kv-v2 to enable the KV Secrets Engine. V2 is the recommended version for Vault.

These values are manually created for testing purposes on the sites.

To enable the secret path to start the creation of secrets in Hashicorp Vault, we will type the following command:

vault secrets enable -path=internal kv-v2

That will enable a secret store of the type kv-v2 (key-value store in its v2), and the path will be “internal,” so everything else that we create after that will be under this “internal” root path.

And now, we’re going to do the creation of the secret in Hashicorp Vault, and as we are using a key-value store, the syntax is also related to that because we are going to “put” a secret using the following command:

vault kv put internal/database/config username="db-readonly-username" password="db-secret-password"

That will create inside the internal path a child path /database/config where it will store two keys:

• username that will have the value db-readonly-username
• password that will have the value db-secret-password

As you can see, it is quite easy to create new secrets on the Vault linked to the path, and if you want to retrieve its content, you can also do it using the Vault CLI, but this time using the get command as shown in the snippet below:

vault kv get internal/database/config

And the output will be similar to the one shown below:

This will help you interact with your store’s content to retrieve, add or update what you already have there. Once you have everything ready there, we can move to the client side to configure it to gather all this data as part of its lifecycle workflow.

Vault Secrets List

The vault secrets list -detailed the command is used to list all of the enabled secret engines in Vault along with their configuration details.

Vault provides a way to store and manage secrets using various secret engines. Secrets engines are logical components within Vault that provide a way to generate, store, and access secrets. For example, Vault provides secrets engines for storing and managing secrets related to databases, key-value pairs, certificates, and more.

The vault secrets list the command is used to list all of the enabled secrets engines in Vault. When used with the -detailed option, the command provides additional configuration details for each secret engine.

For example, the following command lists all of the enabled secrets engines in Vault along with their configuration details:

vault secrets list -detailed

This command will return a list of all of the enabled secrets engines in Vault along with their configuration details, such as the mount path, description, and default lease duration.

By using the vault secrets list command, you can see what secrets engines are enabled in Vault and their configurations, which can help you manage and use secrets more effectively.

Configure the application to retrieve the MySQL credentials from Vault:

vault read secret/databases/mysql

vault kv get secret/databases/mysql

By following these steps, you can store your MySQL credentials securely in HashiCorp Vault and retrieve them safely for your application.

“It is crucial to note that if WordPress, MySQL, Apache2, and PHP are not already installed on the server, it is necessary to follow the steps in the article to ensure that your system has all of the required dependencies to utilize Vault effectively.”

Photo by Justin Morgan on Unsplash

👇👇👇👇👇👇👇👇👇👇👇👇👇👇

Click the Link and install WordPress…….. 👈

Click the Link and install MySQL…….. 👈

Click the Link and install Apache2…….. 👈

Click the Link and install PHP…….. 👈

👇👇👇👇👇👇👇👇👇👇👇👇👇👇

https://medium.com/@janushanth03/-66a285dee15e 👈

Assuming WordPress and databases are installed successfully, you may move on to creating the policy.

Vault Policy Write

In Vault, policies are used to define access controls for different paths and operations within Vault. The vault policy write the command is used to create or update a policy in Vault.

Get Janushanth Sivaratnam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In this case, the mysql-policy policy is being created to define access controls for the secret/databases/mysql path. The policy is defined using the HashiCorp Configuration Language (HCL) syntax, which allows you to specify the capabilities that a particular path should have.

The capabilities the parameter specifies the operations that are allowed on the path. In this case, the policy is granting create, read, update, delete, and list capabilities for the secret/databases/mysql path.

The <<EOF the syntax is used to specify the policy document using a heredoc. The policy document is defined between the EOF delimiters.

Once the mysql-policy the policy has been created, it can be associated with a user or group using the vault auth command. By associating the policy with a user or group, you can control access to the secret/databases/mysql path in Vault.

By creating and applying policies in Vault, you can enforce access controls and ensure that only authorized users or services can access sensitive data stored in Vault. This provides a way to securely manage secrets and credentials for your applications and services.

For example, you can create a policy that allows read and write access to the secret/databases/mysql path using the following HCL code:

path "secret/databases/mysql" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

Here, we can apply the create, read, update, delete, and list policies, but for better security, we should use read-only databases.
You can then write this policy to Vault using the vault policy write command:

vault policy write mysql-policy - <<EOF
path "secret/databases/mysql" {
  capabilities = ["read"]
}
EOF

Finally, you can associate the policy with the token or user using the vault token create command, depending on how you authenticate with Vault.

Vault Token Create

The vault token create the command is used to create a new token in Vault with the specified policies and other options. In this case, the mysql-policy policy is assigned to the token.

When the vault token create command is executed with the -policy option followed by the name of the policy, Vault creates a new token that has the permissions specified in the policy.

For example, the following command creates a new token with the mysql-policy policy:

# If using tokens:
vault token create -policy=mysql-policy

This command will create a new token with the permissions specified in the mysql-policy policy. The token can be used to authenticate and authorize access to secrets and other resources in Vault.

By creating tokens with specific policies, you can control access to secrets and other resources in Vault. You can create tokens with different policies for different users or services, and revoke them as needed to ensure that only authorized users or services can access sensitive data stored in Vault. This provides a way to securely manage secrets and credentials for your applications and services.

You must test this KV get method by entering the username and password first.

vault login [root_token]

or else you check with the policy token

vault kv get -field=password secret/databases/mysql
vault kv get -field=username secret/databases/mysql

Following that, you can use the CURL approach since sometimes you will receive an HTTPS certificate, enabling you to identify certain objects.

You can now proceed with verifying that the Vault API is accessible from your web server and that the Vault token you are using has the appropriate permissions to read the secret/databases/mysql path.

You can use the curl command to test the Vault API from your server. For example, you can run the following command in the terminal of your server:

curl --header "X-Vault-Token: your_custom_token" https://vault_address:8200/v1/secret/databases/mysql

curl --header "X-Vault-Token: curl --header "X-Vault-Token: hvs.CAESIDekDYwi6zwspnuNwzNXgyNTjaT3X2p0M0EqZNlJTcTJGh4KHGh2cy5lcWQwaUd0VTJ0WjliZXljdVhJZ3hkZnU" https://127.0.0.1:8200/v1/secret/databases/mysql" https://127.0.0.1:8200/v1/secret/databases/mysql

to understand, please see my key. You must enter your policy key.

Replace your_vault_token with your actual Vault token and vault_address with the address of your Vault server.

This should return the contents of the secret/databases/mysql path, including the MySQL username and password.

If you are able to retrieve the MySQL username and password using curl, but not from your PHP code, make sure that you are passing the correct Vault token to the vault kv get command in your PHP code. You should also make sure that your PHP code is running in the correct environment and has access to the Vault token.

if you get any issues like permission issues in you have to double-check the policy

Delete the policy and recreate and use the policy key
If you are still encountering issues, check the Vault server logs for any error messages that may help diagnose the issue.

If you’re unable to run the HTTPS connection more successfully, you must create the SSL certificate. Please read that article and carefully install the certificate.

👇👇👇👇👇👇👇👇👇👇👇👇👇👇

https://medium.com/@janushanth03/-a5a5b68a3207 👈

Click the Link and install SSL certificates…….. 👈

If the certificate installation goes smoothly, you can continue to edit the WordPress configuration file.

To use the MySQL credentials stored in HashiCorp Vault in your WordPress application, you can modify the wp-config.php file

putenv("VAULT_TOKEN=your policy token");
define('DB_USER', trim(shell_exec('vault kv get -field=username secret/databases/mysql')));
define('DB_PASSWORD', trim(shell_exec('vault kv get -field=password secret/databases/mysql')));

if you want to store the DBhost and DBname you can use them the same way.

after that, you have to restart the apache2

sudo service apache2 restart

I’ll provide several examples of the troubleshooting approach here.

Photo by ThisisEngineering RAEng on Unsplash

The error you are seeing in the Apache error log indicates that there is a problem with the Vault API request. The error message suggests that the client is not authorized to perform the requested operation.

If you experience a problem, you can investigate it by looking in the Apache2 error log.

tail -f /var/log/apache2/error.log

To troubleshoot this issue, you may want to check the Vault server logs to see if there is any more information about the error. You should also check that the Vault token you are using has the appropriate permissions to read the secret/databases/mysql path.

Regarding the PHP code you are using to retrieve the MySQL username and password from Vault, there are a few things you can check:

1. Make sure that the shell_exec function is enabled in your PHP configuration. Some hosting providers disable this function for security reasons.

You can check if shell_exec() is enabled on your server by creating a PHP file with the following contents:

<?php
echo "shell_exec: " . (function_exists('shell_exec') ? 'enabled' : 'disabled');
?>

Save the file with an .php extension, for example check_shell_exec.php, and upload it to your web server.

Then, access the file in your web browser by navigating to http://yourserver.com/check_shell_exec.php. You should see a message indicating whether shell_exec() is enabled or disabled on your server.

If shell_exec() is disabled, you may need to contact your hosting provider to enable it or use an alternative method for retrieving the MySQL username and password from Vault.

2. Verify that the Vault API is accessible from your web server. If Vault is running on a different server or on a different network, you may need to configure your firewall or network settings to allow access to the Vault API.

3. Check that the Vault token you are using is valid and has the appropriate permissions to access the secret/databases/mysql path.

4. Test the shell commands you are using to retrieve the MySQL username and password from the command line to ensure that they are working correctly.

5. Consider using a PHP library for interacting with Vault instead of calling shell commands directly. This can make your code more robust and secure.

Once you have verified that the Vault API is accessible and your PHP code is working correctly, you should be able to retrieve the MySQL username and password from Vault and use them to connect to your database.

Conclusion

The article discusses a secure storing method for MySQL credentials using Hashicorp Vault, a step-by-step guide that aims to help pass credentials securely to applications. Hashicorp Vault is a tool that provides a secure way to store and manage sensitive data, such as passwords, tokens, and keys.

This process involves configuring Vault, creating a policy to manage the access controls of the stored secrets, and generating tokens for applications to access the stored secrets. By using this method, developers can reduce the risk of exposing sensitive information and ensure that their applications’ credentials are secure.

Overall, the article provides practical information for developers who want to learn how to use Hashicorp Vault to store MySQL credentials securely.