luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity

Update title and other minor changes.

Browse source
This commit is contained in:
Cameron Stokes 2017-01-24 08:47:53 -08:00
parent c19e7ce793
commit a898996c43
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
website/source/docs/guides/generate-root.html.md
View file

@ -1,12 +1,12 @@
---
layout: "docs"
page_title: "Generate Root"
page_title: "Generate Root Tokens Using Unseal Keys"
sidebar_current: "docs-guides-generate-root"
description: |-
Generate a new root key using a threshold of unseal keys.
Generate a new root token using a threshold of unseal keys.
---
# Generate a root token (when none exists)
# Generate Root Tokens Using Unseal Keys
It's considered [best practice](../concepts/tokens.html#root-tokens) not to
keep root tokens around, as they are all-powerful. Instead, if one is
@ -15,10 +15,10 @@ absolutely needed, create it using Vault's `generate-root` command:
1. Unseal the vault. You do not need to be authenticated (you do not need an
existing root token).
2. Generate a one-time password with `vault generate-root -genotp`.
3. Get the encoded root token: `vault generate-root -otp <generated_otp>`
3. Get the encoded root token with `vault generate-root -otp <generated_otp>`.
(Requires a quorum of unseal keys again, so needs to be done \<quorum\> times.)
4. Decode the encoded root token with
`vault generate-root -otp <generated_otp> -decode=<encoded_root_token> `
`vault generate-root -otp <generated_otp> -decode=<encoded_root_token>`.
See `vault generate-root -help` for information on the alternate technique
using a PGP key.