I'm trying to set up the Hashicorp Vault Agent as a systemd service. I can manually run that agent with the user vault.
Note, perhaps that's important: here's the /etc/passwd for that user :
So I need to do
sudo su -s /bin/bash vault to get a vault session.
With that in mind, I can do the
vault agent -config=<pathToConfig>and it works.
Now here the
/usr/lib/systemd/system/vault-agent.service I've set up :
[Unit] Description="HashiCorp Vault - A tool for managing secrets" Documentation=https://www.vaultproject.io/docs/ Requires=network-online.target After=network-online.target ConditionFileNotEmpty=/etc/vault.d/vault.hcl [Service] User=vault Group=vault ProtectSystem=full ProtectHome=read-only PrivateTmp=yes PrivateDevices=yes SecureBits=keep-caps AmbientCapabilities=CAP_IPC_LOCK Capabilities=CAP_IPC_LOCK+ep CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK NoNewPrivileges=yes ExecStart=/bin/vault agent -non-interactive -config=/etc/vault.d/agent-config-prod.hcl ExecReload=/bin/kill --signal HUP $MAINPID KillMode=process KillSignal=SIGINT Restart=no RestartSec=5 TimeoutStopSec=30 StartLimitIntervalSec=60 StartLimitBurst=3 LimitNOFILE=65536 [Install] WantedBy=multi-user.target
This is a service conf I've found multiple times.
But I always get the same issue:
Error storing PID: could not open pid file: open ./pidfile: permission denied
I tried to replace the ExecStart= by /bin/whoami, just to be sure, yes, it's indeed vault. Permission and location of that ./pidfile (default install location):
/etc/vault.d/pidfile drwxr-xr-x. 108 root root 8192 May 15 16:32 etc drwxr-xr-x 3 vault vault 113 May 15 17:43 vault.d -rwxrwxrwx 1 vault vault 0 May 15 17:48 pidfile #not default permission, but I am desesperate.
I am really suspicous about the sudo
su -s /bin/bash vault command that, perhaps, grants the vault user more privileges. If so, how to incorporate it into my service?
I ran systemctl reload daemon everytime and SELinux is disable.
ps: if someone has a great link about how to set up a systemd for the vault AGENT (not as root), I'll take it.
sudo -s /bin/bash vault
$ sudo -s /bin/bash vault /bin/vault: cannot execute binary file $ su -s /bin/bash vault Password: (and I have no password or I don't know it)
So that's why I'm using the full
sudo su -s /bin/bash vault command.