Installing and Configuring HashiCorp Vault

Create Vault User and Group

Create a dedicated Vault system user and group. This account is used by the Vault service and does not require login access.

1. Create a vault group.

# groupadd vault 

2. Create a vault User.

# useradd --system --no-create-home --shell /sbin/nologin --gid vault vault

Download, Install and Configure the Vault

1. Log in as root, unzip the binary file, and extract it to /usr/local/bin.

# cd /tmp
# unzip vault_2.1.0+ent.hsm_linux_amd64 -d
# mv vault /usr/local/bin

2. Set vault permissions.

# chmod 755 /usr/local/bin/vault
# setcap cap_ipc_lock=+ep /usr/local/bin/vault

3. Add Vault to the system PATH by creating a shell script under /etc/profile.d.
   This step ensures that all users, including service users like vault can run the vault command without needing to type the full path.

# echo 'export PATH=$PATH:/usr/local/bin' > /etc/profile.d/vault.sh
# chmod +x /etc/profile.d/vault.sh
# source /etc/profile.d/vault.sh

4. Create the Vault data directories.

# mkdir --parents /opt/vault/data 
# mkdir --parents /opt/vault/logs

5. Confirm that the binary file is available.

# vault version
# vault

Install the Vault Enterprise License

Vault Enterprise requires a valid license file license.hclic to enable enterprise features, including PKCS#11-based HSM integration.

1. Create the Vault configuration directory if it has not already been done.

# mkdir /etc/vault

2. Copy the license file to the Vault configuration path.

# mv /home/<user>/Downloads/license.hclic /etc/vault/
# chown vault:vault /etc/vault/license.hclic
# chmod 640 /etc/vault/license.hclic