apt install gpgwget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.listsudo apt update && sudo apt install vault

# 创建 CA 私钥，生成一个新的私钥文件 ca.keyopenssl genrsa -out ca.key 4096
# 接下来，使用以下命令自签名生成 CA 证书openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=国家/ST=省份/L=城市/O=公司/OU=组织/CN=域名"
# 效验 CA 证书openssl x509 -noout -text -in ca.crt
# 创建 Server 私钥，生成一个新的私钥文件 serverkey.pemopenssl genrsa -out server.key 2048
# 创建服务器证书请求,使用以下命令生成服务器证书请求openssl req -new -key server.key -out server.csr -subj "/C=国家/ST=省份/L=城市/O=公司/OU=组织/CN=域名"
# 使用 CA 签署服务器证书,向 CA 提交服务器证书请求文件 server.csr。接下来，使用以下命令生成服务器证书echo subjectAltName=IP:127.0.0.1,IP:10.xxxxx,IP:10.xxxxx > extfile.cnfecho 01 > ca.srlopenssl x509 -req -extfile extfile.cnf -days 18250 -CA ca.crt -CAkey ca.key -in server.csr -out server.crt
# 最后，将生成的 servercert.pem serverkey.pem 文件安装到 Web 服务器上，以供 SSL/TLS 连接使用

ui = truedisable_mlock = false
storage "mysql" {  address = "IP:3306"  username = "vault"  password = "xxxxxxx"  database = "vault"  table = "vault"  ha_enabled = "true"  max_connection_lifetime = "7200"  max_idle_connections = "5"  max_parallel = "128"}
listener "tcp" {  address = "0.0.0.0:8200"  tls_cert_file = "/opt/vault/tls/server.crt"  tls_key_file  = "/opt/vault/tls/server.key"  tls_disable = false  telemetry {    unauthenticated_metrics_access = true  }}
api_addr = "https://IP:8200"cluster_addr = "https://ip:8201"cluster_name = "cluster-name"
log_level = "trace"log_format = "json"log_file = "/opt/vault/log/server/"log_rotate_bytes = "102400"log_rotate_max_files = "200"
telemetry {  prometheus_retention_time = "300s"  disable_hostname = true}

mkdir -p /var/log/vault/chown vault:vault /var/log/vault/

# 启动服务systemctl start vault.service# 开机自动重启systemctl enable vault.service

vault operator init -key-shares=3 -key-threshold=2

vault operator unseal

# 在opt/vault下面，创建目录/opt/vault/log,授权目录给vault用户mkdir -p /opt/vault/log/auditchown vault:vault /opt/vault/log/audit# 创建审计设备(需先创建好vault_audit.log,并修改该文件所有者和组)（登录root进去创建）vault audit enable file file_path=/opt/vault/log/audit/vault-audit.log# 注意：每个节点需要单独创建独立的日志设备（官方建议）(加入日志轮换)

# 配置这些参数api_addr = "https://127.0.0.1:8200"cluster_addr = "https://<Node-1-IP>:8201"cluster_name = "vault-XX-cluster"

vault write -f auth/ldap/config     url="ldap://ldap地址"     userfilter:"(&(memberOf=cn=xxx,ou=xxx,ou=xxxx,dc=xxxx,dc=xxx)(uid={{.Username}}))" ........

创建一个TOTP方法，并将该方法的强制执行绑定到LDAP身份认证方式

# 生成该实体的TOTP二维码或者secreet密钥vault write identity/mfa/method/totp/admin-generate method_id=METHOD_ID entity_id=ENTITY_ID

先登录，再给每个ldap用户改实体名（实体名字和别名和ldap用户名一样）