How to find a list of tokens provisioned using a specific admin token

340 views
Skip to first unread message

Will Pinney

unread,
Mar 3, 2017, 12:26:19 PM3/3/17
to Vault
All, 

It looks like there is a lot of tokens being left with the expiration date 32 days away. I would like to find out all these tokens and manually delete them. 

How do I find a list of tokens provisioned using a specific admin token? I can not find such a command. 

Thanks.


Will

Jeff Mitchell

unread,
Mar 3, 2017, 1:00:18 PM3/3/17
to Vault
Hi Will,

The only current way to do something like this is to iterate via a list operation on the auth/token/accessors function. You can then do a lookup on each accessor and check the expiration date, then you can use the revoke-accessor endpoint to revoke any you like.

Best,
Jeff

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/vault/issues
IRC: #vault-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Vault" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/741648d2-8740-465d-9819-1f2195627e41%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Randy Fay

unread,
Mar 4, 2017, 11:36:18 PM3/4/17
to vault...@googlegroups.com
The vault_token_lister tool (https://github.com/drud/vault_token_lister) is currently set up to give you a list of tokens based on policy (or all tokens), but could easily be adapted for your purpose, Will.

To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/CAORe8GEDWsvZOt7KU-OHNLZh%2B5m76%3D0EPtYDgYvyUL0iwiTEzQ%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.



--

Will Pinney

unread,
Mar 6, 2017, 2:20:14 PM3/6/17
to Vault

Randy, Thank you for the info. I tried the master branch version of vault_token_lister-master. I got the following error: 

$ vault_token_lister-master -policy pepmgr_policy -rootToken xxxxx  -targetVaultAddr https://xxxx:8200

panic: runtime error: invalid memory address or nil pointer dereference

[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x4013f1]


goroutine 1 [running]:

panic(0x63ace0, 0xc4200120b0)

/usr/lib/go/src/runtime/panic.go:500 +0x1a1

main.main()

/home/dood/git/src/vault_token_lister-master/vault_token_lister.go:35 +0x3f1



Any suggestions? 

On Saturday, March 4, 2017 at 11:36:18 PM UTC-5, Randy Fay wrote:
The vault_token_lister tool (https://github.com/drud/vault_token_lister) is currently set up to give you a list of tokens based on policy (or all tokens), but could easily be adapted for your purpose, Will.
On Fri, Mar 3, 2017 at 10:59 AM, Jeff Mitchell <je...@hashicorp.com> wrote:
Hi Will,

The only current way to do something like this is to iterate via a list operation on the auth/token/accessors function. You can then do a lookup on each accessor and check the expiration date, then you can use the revoke-accessor endpoint to revoke any you like.

Best,
Jeff
On Fri, Mar 3, 2017 at 12:26 PM, Will Pinney <willow.p...@gmail.com> wrote:
All, 

It looks like there is a lot of tokens being left with the expiration date 32 days away. I would like to find out all these tokens and manually delete them. 

How do I find a list of tokens provisioned using a specific admin token? I can not find such a command. 

Thanks.


Will

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/vault/issues
IRC: #vault-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Vault" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+...@googlegroups.com.

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/vault/issues
IRC: #vault-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Vault" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+...@googlegroups.com.
Message has been deleted

Will Pinney

unread,
Mar 6, 2017, 5:47:56 PM3/6/17
to Vault

All, 


I am getting 500 "Internal Server Error" here trying to do a list on /auth/token/accessors. It also took about 12 minutes to finish.  Any work around? 


~$  curl -vv -k -H "X-Vault-Token: $VAULT_TOKEN" -H "Content-Type: application/json" https://10.135.31.1:8200/v1/auth/token/accessors?list=true 

or 


$ time  curl -vv -k -X LIST  -H "X-Vault-Token: $VAULT_TOKEN" -H "Content-Type: application/json" https://10.135.31.1:8200/v1/auth/token/accessors

* Hostname was NOT found in DNS cache

*   Trying 10.135.31.1...

* Connected to 10.135.31.1 (10.135.31.1) port 8200 (#0)

* successfully set certificate verify locations:

*   CAfile: none

  CApath: /etc/ssl/certs

* SSLv3, TLS handshake, Client hello (1):

* SSLv3, TLS handshake, Server hello (2):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS handshake, Server key exchange (12):

* SSLv3, TLS handshake, Request CERT (13):

* SSLv3, TLS handshake, Server finished (14):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS handshake, Client key exchange (16):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSLv3, TLS change cipher, Client hello (1):

* SSLv3, TLS handshake, Finished (20):

* SSL connection using ECDHE-RSA-AES256-GCM-SHA384

> LIST /v1/auth/token/accessors HTTP/1.1

> User-Agent: curl/7.35.0

> Host: 10.135.31.1:8200

> Accept: */*

> X-Vault-Token: ROOT_TOKEN

> Content-Type: application/json

> 

< HTTP/1.1 500 Internal Server Error

< Content-Type: application/json

< Date: Mon, 06 Mar 2017 20:39:44 GMT

< Content-Length: 30

< 

{"errors":["internal error"]}

* Connection #0 to host 10.135.31.1 left intact


real 12m44.150s

user 0m0.020s

sys 0m0.016s



Jeff Mitchell

unread,
Mar 7, 2017, 7:29:50 AM3/7/17
to Vault
Hi Will,

Without the server logs detailing what the internal error is I can't tell you much.

Best,
Jeff

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/vault/issues
IRC: #vault-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Vault" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+unsubscribe@googlegroups.com.
 To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/4b535fd8-14c7-4d59-8bfc-4e7088ecbc90%40googlegroups.com.

Will Pinney

unread,
Mar 7, 2017, 12:40:03 PM3/7/17
to Vault
Jeff, 

Here is what I got from the vault log: 

2017/03/07 11:33:36.596848 [ERR] audit: backend failed to log response backend=syslog/ error=write unixgram @->/dev/log: i/o timeout

2017/03/07 11:33:36.596904 [ERR] core: failed to audit response request_path=auth/token/accessors error=no audit backend succeeded in logging the response




How to fix it? 
To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+...@googlegroups.com.

Jeff Mitchell

unread,
Mar 7, 2017, 1:12:24 PM3/7/17
to Vault
Hi Will,

See the section on Blocked Audit Backends at https://www.vaultproject.io/docs/audit/index.html

If you don't trust your syslog not to block, you may want to consider e.g. writing to a file and having syslog pick up from there.

Best,
Jeff

To unsubscribe from this group and stop receiving emails from it, send an email to vault-tool+unsubscribe@googlegroups.com.
 To view this discussion on the web visit https://groups.google.com/d/msgid/vault-tool/4b4defca-67f2-4ef1-8dca-9afb92fb7a34%40googlegroups.com.

Will Pinney

unread,
Mar 7, 2017, 10:05:51 PM3/7/17
to Vault
Thanks, Jeff. I finally got the key.  Now,  how I use the accessors? 

I tried the following with no success: 

$ vault token-lookup -accessor 7fd0b90c-1704-f684-d1dd-4823d9da9f2a

error looking up token: Error making API request.


URL: POST https://127.0.0.1:8200/v1/auth/token/lookup-accessor/7fd0b90c-1704-f684-d1dd-4823d9da9f2a

Code: 403. Errors:


* 1 error(s) occurred:


* permission denied


Where "7fd0b90c-1704-f684-d1dd-4823d9da9f2a" is from the "keys" section of json output of :

 curl -vv -k -X LIST  -H "X-Vault-Token: $VAULT_TOKEN" -H "Content-Type: application/json" https:/ip.addr.here.1:8200/v1/auth/token/accessors

Reply all
Reply to author
Forward
0 new messages