Vault-Cli

Github Repo of CLI-Tool Download and install binary for your needed OS

Tip

with Go

If you have go installed, you can just do

go install github.com/cryptvault-cloud/vault-cli@latest

with Docker

You can also simply use the CLI via Docker image.

Only mount local volume to /work to persist data.

sudo docker run -it --entrypoint='/bin/sh' -w /work -v ./cryptvault:/work ghcr.io/cryptvault-cloud/vault-cli:latest

Now you can run vault-cli commands and files will be saved to the filesystem.

The Cli can be used to communicate with the Vault Server.

It stores private keys and management information in the ./.cryptvault folder.

It is possible to manage multiple vaults with one Cryptvault directory.

Caution

The ./.cryptvault directory is worth protecting and should not be deleted, as all private keys created are stored here and cannot be restored.

The Vault-Cli is divided into three main areas.

• Working with local resources
• Creating a new vault
• Working in the protected area

Tip

You can always use --help to see descriptions of each command and subcommand.

vault-cli local create --help

Local

This area is particularly useful for people/groups who are not Vault Admins and want to use the Cli to manage their sub-areas.

See handling example

Tip

All local commands do not communicate with the server and therefore do not perform any checks

Init

You can create vaults locally that you do not own by knowing the vaultid:

# init a local folder structure for vault by known vaultid
vault-cli local init --vaultName "OrgName" --id "vaultid"

create identity

New identities are created that only reside on the file system:

# create a local keypair identity will be saved at local folder structure
vault-cli local create identity --name "TeamKeyPair"

This makes it possible to generate key pairs and then send the public key to the Vault owner.

The public key can be found at ./.cryptvault/{vault_name}/identity/{identity_name}/key.pub

create vault

Utilize this command to establish a new vault with a token, a one-time requirement.

It generates local operator identity key pairs for vault creation on the server.

Caution

Since only the public key is sent to the server for verification, safeguarding the private key is crucial. Losing the private key irreversibly compromises operator access to the Vault.

protected area

CLI commands for Vault usage require identity signature verification for validation.

This can be used for secrets and identities to:

• added
• queried
• updated
• deleted

example to add an identity:

vault-cli protected --creds .cryptvault/$VAULT_CLI_VAULTNAME/operator/key add identity --name A_Team --r '(rwd)IDENTITY.>' --r '(rwd)VALUES.a_team.>' --r '(rwd)VALUES.search_team.a_team.>'

Tip

Any registered identity can be used to execute this command. However, this person must have the appropriate permissions.

Learn more about identities rights