open-vault/CHANGELOG.md

0.6.0 (Unreleased)

SECURITY:

• Although sys/revoke-prefix was intended to revoke prefixes of secrets (via lease IDs, which incorporate path information) and auth/token/revoke-prefix was intended to revoke prefixes of tokens (using the tokens' paths and, since 0.5.2, role information), in implementation they both behaved exactly the same way since a single component in Vault is responsible for managing lifetimes of both, and the type of the tracked lifetime was not being checked. The end result was that either endpoint could revoke both secret leases and tokens. We consider this a very minor security issue as there are a number of mitigating factors: both endpoints require sudo capability in addition to write capability, preventing blanket ACL path globs from providing access; both work by using the prefix to revoke as a part of the endpoint path, allowing them to be properly ACL'd; and both are intended for emergency scenarios and users should already not generally have access to either one. In order to prevent confusion, we have simply removed auth/token/revoke-prefix in 0.6, and sys/revoke-prefix will be meant for both leases and tokens instead.

DEPRECATIONS/BREAKING CHANGES:

• auth/token/revoke-prefix has been removed. See the security notice for details. [GH-1280]

IMPROVEMENTS:

• command/auth: Restore the previous authenticated token if the auth command fails to authenticate the provided token [GH-1233]
• command/write: -format and -field can now be used with the write command [GH-1228]
• core: Add mlock support for FreeBSD, OpenBSD, NetBSD, and Darwin [GH-1297]
• core: Don't keep lease timers around when tokens are revoked [GH-1277]
• credential/cert: Renewal requests are rejected if the set of policies has changed since the token was issued [GH-477]
• credential/ldap: If groupdn is not configured, skip searching LDAP and only return policies for local groups, plus a warning [GH-1283]
• secret/pki: Added exclude_cn_from_sans field to prevent adding the CN to DNS or Email Subject Alternate Names [GH-1220]
• sys/capabilities: Enforce ACL checks for requests that query the capabilities of a token on a given path [GH-1221]

BUG FIXES:

• command/read: Fix panic when using -field with a non-string value [GH-1308]
• command/token-lookup: Fix TTL showing as 0 depending on how a token was created. This only affected the value shown at lookup, not the token behavior itself. [GH-1306]
• credential/ldap: Fix problem where certain error conditions when configuring or opening LDAP connections would cause a panic instead of return a useful error message [GH-1262]
• credential/token: Fall back to normal parent-token semantics if allowed_policies is empty for a role. Using allowed_policies of default resulted in the same behavior anyways. [GH-1276]
• credential/various: Fix renewal conditions when default policy is not contained in the backend config [GH-1256]
• secret/pki: Don't check whether a certificate is destined to be a CA certificate if sign-verbatim endpoint is used [GH-1250]

0.5.2 (March 16th, 2016)

FEATURES:

• MSSQL Backend: Generate dynamic unique MSSQL database credentials based on configured roles [GH-998]
• Token Accessors: Vault now provides an accessor with each issued token. This accessor is an identifier that can be used for a limited set of actions, notably for token revocation. This value can be logged in plaintext to audit logs, and in combination with the plaintext metadata logged to audit logs, provides a searchable and straightforward way to revoke particular users' or services' tokens in many cases. To enable plaintext audit logging of these accessors, set hmac_accessor=false when enabling an audit backend.
• Token Credential Backend Roles: Roles can now be created in the token credential backend that allow modifying token behavior in ways that are not otherwise exposed or easily delegated. This allows creating tokens with a fixed set (or subset) of policies (rather than a subset of the calling token's), periodic tokens with a fixed TTL but no expiration, specified prefixes, and orphans.
• Listener Certificate Reloading: Vault's configured listeners now reload their TLS certificate and private key when the Vault process receives a SIGHUP.

IMPROVEMENTS:

• auth/token: Endpoints optionally accept tokens from the HTTP body rather than just from the URLs [GH-1211]
• auth/token,sys/capabilities: Added new endpoints auth/token/lookup-accessor, auth/token/revoke-accessor and sys/capabilities-accessor, which enables performing the respective actions with just the accessor of the tokens, without having access to the actual token [GH-1188]
• core: Ignore leading / in policy paths [GH-1170]
• core: Ignore leading / in mount paths [GH-1172]
• command/policy-write: Provided HCL is now validated for format violations and provides helpful information around where the violation occurred [GH-1200]
• command/server: The initial root token ID when running in -dev mode can now be specified via -dev-root-token-id or the environment variable VAULT_DEV_ROOT_TOKEN_ID [GH-1162]
• command/server: The listen address when running in -dev mode can now be specified via -dev-listen-address or the environment variable VAULT_DEV_LISTEN_ADDRESS [GH-1169]
• command/server: The configured listeners now reload their TLS certificates/keys when Vault is SIGHUP'd [GH-1196]
• command/step-down: New vault step-down command and API endpoint to force the targeted node to give up active status, but without sealing. The node will wait ten seconds before attempting to grab the lock again. [GH-1146]
• command/token-renew: Allow no token to be passed in; use renew-self in this case. Change the behavior for any token being passed in to use renew. [GH-1150]
• credential/app-id: Allow app-id parameter to be given in the login path; this causes the app-id to be part of the token path, making it easier to use with revoke-prefix [GH-424]
• credential/cert: Non-CA certificates can be used for authentication. They must be matched exactly (issuer and serial number) for authentication, and the certificate must carry the client authentication or 'any' extended usage attributes. [GH-1153]
• credential/cert: Subject and Authority key IDs are output in metadata; this allows more flexible searching/revocation in the audit logs [GH-1183]
• credential/cert: Support listing configured certs [GH-1212]
• credential/userpass: Add support for create/update capability distinction in user path, and add user-specific endpoints to allow changing the password and policies [GH-1216]
• credential/token: Add roles [GH-1155]
• secret/mssql: Add MSSQL backend [GH-998]
• secret/pki: Add revocation time (zero or Unix epoch) to pki/cert/SERIAL endpoint [GH-1180]
• secret/pki: Sanitize serial number in pki/revoke endpoint to allow some other formats [GH-1187]
• secret/ssh: Added documentation for ssh/config/zeroaddress endpoint. [GH-1154]
• sys: Added new endpoints sys/capabilities and sys/capabilities-self to fetch the capabilities of a token on a given path [GH-1171]
• sys: Added sys/revoke-force, which enables a user to ignore backend errors when revoking a lease, necessary in some emergency/failure scenarios [GH-1168]
• sys: The return codes from sys/health can now be user-specified via query parameters [GH-1199]

BUG FIXES:

• logical/cassandra: Apply hyphen/underscore replacement to the entire generated username, not just the UUID, in order to handle token display name hyphens [GH-1140]
• physical/etcd: Output actual error when cluster sync fails [GH-1141]
• vault/expiration: Not letting the error responses from the backends to skip during renewals [GH-1176]

0.5.1 (February 25th, 2016)

DEPRECATIONS/BREAKING CHANGES:

• RSA keys less than 2048 bits are no longer supported in the PKI backend. 1024-bit keys are considered unsafe and are disallowed in the Internet PKI. The pki backend has enforced SHA256 hashes in signatures from the beginning, and software that can handle these hashes should be able to handle larger key sizes. [GH-1095]
• The PKI backend now does not automatically delete expired certificates, including from the CRL. Doing so could lead to a situation where a time mismatch between the Vault server and clients could result in a certificate that would not be considered expired by a client being removed from the CRL. The new pki/tidy endpoint can be used to trigger expirations. [GH-1129]
• The cert backend now performs a variant of channel binding at renewal time for increased security. In order to not overly burden clients, a notion of identity is used. This functionality can be disabled. See the 0.5.1 upgrade guide for more specific information [GH-1127]

FEATURES:

• Codebase Audit: Vault's 0.5 codebase was audited by iSEC. (The terms of the audit contract do not allow us to make the results public.) [GH-220]

IMPROVEMENTS:

• api: The VAULT_TLS_SERVER_NAME environment variable can be used to control the SNI header during TLS connections [GH-1131]
• api/health: Add the server's time in UTC to health responses [GH-1117]
• command/rekey and command/generate-root: These now return the status at attempt initialization time, rather than requiring a separate fetch for the nonce [GH-1054]
• credential/cert: Don't require root/sudo tokens for the certs/ and crls/ paths; use normal ACL behavior instead [GH-468]
• credential/github: The validity of the token used for login will be checked at renewal time [GH-1047]
• credential/github: The config endpoint no longer requires a root token; normal ACL path matching applies
• deps: Use the standardized Go 1.6 vendoring system
• secret/aws: Inform users of AWS-imposed policy restrictions around STS tokens if they attempt to use an invalid policy [GH-1113]
• secret/mysql: The MySQL backend now allows disabling verification of the connection_url [GH-1096]
• secret/pki: Submitted CSRs are now verified to have the correct key type and minimum number of bits according to the role. The exception is intermediate CA signing and the sign-verbatim path [GH-1104]
• secret/pki: New tidy endpoint to allow expunging expired certificates. [GH-1129]
• secret/postgresql: The PostgreSQL backend now allows disabling verification of the connection_url [GH-1096]
• secret/ssh: When verifying an OTP, return 400 if it is not valid instead of 204 [GH-1086]
• credential/app-id: App ID backend will check the validity of app-id and user-id during renewal time [GH-1039]
• credential/cert: TLS Certificates backend, during renewal, will now match the client identity with the client identity used during login [GH-1127]

BUG FIXES:

• credential/ldap: Properly escape values being provided to search filters [GH-1100]
• secret/aws: Capping on length of usernames for both IAM and STS types [GH-1102]
• secret/pki: If a cert is not found during lookup of a serial number, respond with a 400 rather than a 500 [GH-1085]
• secret/postgresql: Add extra revocation statements to better handle more permission scenarios [GH-1053]
• secret/postgresql: Make connection_url work properly [GH-1112]

0.5.0 (February 10, 2016)

SECURITY:

• Previous versions of Vault could allow a malicious user to hijack the rekey operation by canceling an operation in progress and starting a new one. The practical application of this is very small. If the user was an unseal key owner, they could attempt to do this in order to either receive unencrypted reseal keys or to replace the PGP keys used for encryption with ones under their control. However, since this would invalidate any rekey progress, they would need other unseal key holders to resubmit, which would be rather suspicious during this manual operation if they were not also the original initiator of the rekey attempt. If the user was not an unseal key holder, there is no benefit to be gained; the only outcome that could be attempted would be a denial of service against a legitimate rekey operation by sending cancel requests over and over. Thanks to Josh Snyder for the report!

DEPRECATIONS/BREAKING CHANGES:

• s3 physical backend: Environment variables are now preferred over configuration values. This makes it behave similar to the rest of Vault, which, in increasing order of preference, uses values from the configuration file, environment variables, and CLI flags. [GH-871]
• etcd physical backend: sync functionality is now supported and turned on by default. This can be disabled. [GH-921]
• transit: If a client attempts to encrypt a value with a key that does not yet exist, what happens now depends on the capabilities set in the client's ACL policies. If the client has create (or create and update) capability, the key will upsert as in the past. If the client has update capability, they will receive an error. [GH-1012]
• token-renew CLI command: If the token given for renewal is the same as the client token, the renew-self endpoint will be used in the API. Given that the default policy (by default) allows all clients access to the renew-self endpoint, this makes it much more likely that the intended operation will be successful. [GH-894]
• Token lookup: the ttl value in the response now reflects the actual remaining TTL rather than the original TTL specified when the token was created; this value is now located in creation_ttl [GH-986]
• Vault no longer uses grace periods on leases or token TTLs. Uncertainty about the length grace period for any given backend could cause confusion and uncertainty. [GH-1002]
• rekey: Rekey now requires a nonce to be supplied with key shares. This nonce is generated at the start of a rekey attempt and is unique for that attempt.
• status: The exit code for the status CLI command is now 2 for an uninitialized Vault instead of 1. 1 is returned for errors. This better matches the rest of the CLI.

FEATURES:

• Split Data/High Availability Physical Backends: You can now configure two separate physical backends: one to be used for High Availability coordination and another to be used for encrypted data storage. See the configuration documentation for details. [GH-395]
• Fine-Grained Access Control: Policies can now use the capabilities set to specify fine-grained control over operations allowed on a path, including separation of sudo privileges from other privileges. These can be mixed and matched in any way desired. The policy value is kept for backwards compatibility. See the updated policy documentation for details. [GH-914]
• List Support: Listing is now supported via the API and the new vault list command. This currently supports listing keys in the generic and cubbyhole backends and a few other places (noted in the IMPROVEMENTS section below). Different parts of the API and backends will need to implement list capabilities in ways that make sense to particular endpoints, so further support will appear over time. [GH-617]
• Root Token Generation via Unseal Keys: You can now use the generate-root CLI command to generate new orphaned, non-expiring root tokens in case the original is lost or revoked (accidentally or purposefully). This requires a quorum of unseal key holders. The output value is protected via any PGP key of the initiator's choosing or a one-time pad known only to the initiator (a suitable pad can be generated via the -genotp flag to the command. [GH-915]
• Unseal Key Archiving: You can now optionally have Vault store your unseal keys in your chosen physical store for disaster recovery purposes. This option is only available when the keys are encrypted with PGP. [GH-907]
• Keybase Support for PGP Encryption Keys: You can now specify Keybase users when passing in PGP keys to the init, rekey, and generate-root CLI commands. Public keys for these users will be fetched automatically. [GH-901]
• DynamoDB HA Physical Backend: There is now a new, community-supported HA-enabled physical backend using Amazon DynamoDB. See the configuration documentation for details. [GH-878]
• PostgreSQL Physical Backend: There is now a new, community-supported physical backend using PostgreSQL. See the configuration documentation for details. [GH-945]
• STS Support in AWS Secret Backend: You can now use the AWS secret backend to fetch STS tokens rather than IAM users. [GH-927]
• Speedups in the transit backend: The transit backend has gained a cache, and now loads only the working set of keys (e.g. from the min_decryption_version to the current key version) into its working set. This provides large speedups and potential memory savings when the rotate feature of the backend is used heavily.

IMPROVEMENTS:

• cli: Output secrets sorted by key name [GH-830]
• cli: Support YAML as an output format [GH-832]
• cli: Show an error if the output format is incorrect, rather than falling back to an empty table [GH-849]
• cli: Allow setting the advertise_addr for HA via the VAULT_ADVERTISE_ADDR environment variable [GH-581]
• cli/generate-root: Add generate-root and associated functionality [GH-915]
• cli/init: Add -check flag that returns whether Vault is initialized [GH-949]
• cli/server: Use internal functions for the token-helper rather than shelling out, which fixes some problems with using a static binary in Docker or paths with multiple spaces when launching in -dev mode [GH-850]
• cli/token-lookup: Add token-lookup command [GH-892]
• command/{init,rekey}: Allow ASCII-armored keychain files to be arguments for -pgp-keys [GH-940]
• conf: Use normal bool values rather than empty/non-empty for the tls_disable option [GH-802]
• credential/ldap: Add support for binding, both anonymously (to discover a user DN) and via a username and password [GH-975]
• credential/token: Add last_renewal_time to token lookup calls [GH-896]
• credential/token: Change ttl to reflect the current remaining TTL; the original value is in creation_ttl [GH-1007]
• helper/certutil: Add ability to parse PKCS#8 bundles [GH-829]
• logical/aws: You can now get STS tokens instead of IAM users [GH-927]
• logical/cassandra: Add protocol_version parameter to set the CQL proto version [GH-1005]
• logical/cubbyhole: Add cubbyhole access to default policy [GH-936]
• logical/mysql: Add list support for roles path [GH-984]
• logical/pki: Fix up key usages being specified for CAs [GH-989]
• logical/pki: Add list support for roles path [GH-985]
• logical/pki: Allow pem_bundle to be specified as the format, which provides a concatenated PEM bundle of returned values [GH-1008]
• logical/pki: Add 30 seconds of slack to the validity start period to accommodate some clock skew in machines [GH-1036]
• logical/postgres: Add max_idle_connections paramter [GH-950]
• logical/postgres: Add list support for roles path
• logical/ssh: Add list support for roles path [GH-983]
• logical/transit: Keys are archived and only keys between the latest version and min_decryption_version are loaded into the working set. This can provide a very large speed increase when rotating keys very often. [GH-977]
• logical/transit: Keys are now cached, which should provide a large speedup in most cases [GH-979]
• physical/cache: Use 2Q cache instead of straight LRU [GH-908]
• physical/etcd: Support basic auth [GH-859]
• physical/etcd: Support sync functionality and enable by default [GH-921]

BUG FIXES:

• api: Correct the HTTP verb used in the LookupSelf method [GH-887]
• api: Fix the output of Sys().MountConfig(...) to return proper values [GH-1017]
• command/read: Fix panic when an empty argument was given [GH-923]
• command/ssh: Fix panic when username lookup fails [GH-886]
• core: When running in standalone mode, don't advertise that we are active until post-unseal setup completes [GH-872]
• core: Update go-cleanhttp dependency to ensure idle connections aren't leaked [GH-867]
• core: Don't allow tokens to have duplicate policies [GH-897]
• core: Fix regression in sys/renew that caused information stored in the Secret part of the response to be lost [GH-912]
• physical: Use square brackets when setting an IPv6-based advertise address as the auto-detected advertise address [GH-883]
• physical/s3: Use an initialized client when using IAM roles to fix a regression introduced against newer versions of the AWS Go SDK [GH-836]
• secret/pki: Fix a condition where unmounting could fail if the CA certificate was not properly loaded [GH-946]
• secret/ssh: Fix a problem where SSH connections were not always closed properly [GH-942]

MISC:

• Clarified our stance on support for community-derived physical backends. See the configuration documentation for details.
• Add vault-java to libraries [GH-851]
• Various minor documentation fixes and improvements [GH-839] [GH-854] [GH-861] [GH-876] [GH-899] [GH-900] [GH-904] [GH-923] [GH-924] [GH-958] [GH-959] [GH-981] [GH-990] [GH-1024] [GH-1025]

BUILD NOTE:

• The HashiCorp-provided binary release of Vault 0.5.0 is built against a patched version of Go 1.5.3 containing two specific bug fixes affecting TLS certificate handling. These fixes are in the Go 1.6 tree and were cherry-picked on top of stock Go 1.5.3. If you want to examine the way in which the releases were built, please look at our cross-compilation Dockerfile.

0.4.1 (January 13, 2016)

SECURITY:

• Build against Go 1.5.3 to mitigate a security vulnerability introduced in Go 1.5. For more information, please see https://groups.google.com/forum/#!topic/golang-dev/MEATuOi_ei4

This is a security-only release; other than the version number and building against Go 1.5.3, there are no changes from 0.4.0.

0.4.0 (December 10, 2015)

DEPRECATIONS/BREAKING CHANGES:

• Policy Name Casing: Policy names are now normalized to lower-case on write, helping prevent accidental case mismatches. For backwards compatibility, policy names are not currently normalized when reading or deleting. [GH-676]
• Default etcd port number: the default connection string for the etcd physical store uses port 2379 instead of port 4001, which is the port used by the supported version 2.x of etcd. [GH-753]
• As noted below in the FEATURES section, if your Vault installation contains a policy called default, new tokens created will inherit this policy automatically.
• In the PKI backend there have been a few minor breaking changes:
  • The token display name is no longer a valid option for providing a base domain for issuance. Since this name is prepended with the name of the authentication backend that issued it, it provided a faulty use-case at best and a confusing experience at worst. We hope to figure out a better per-token value in a future release.
  • The allowed_base_domain parameter has been changed to allowed_domains, which accepts a comma-separated list of domains. This allows issuing certificates with DNS subjects across multiple domains. If you had a configured allowed_base_domain parameter, it will be migrated automatically when the role is read (either via a normal read, or via issuing a certificate).

FEATURES:

• Significantly Enhanced PKI Backend: The pki backend can now generate and sign root CA certificates and intermediate CA CSRs. It can also now sign submitted client CSRs, as well as a significant number of other enhancements. See the updated documentation for the full API. [GH-666]
• CRL Checking for Certificate Authentication: The cert backend now supports pushing CRLs into the mount and using the contained serial numbers for revocation checking. See the documentation for the cert backend for more info. [GH-330]
• Default Policy: Vault now ensures that a policy named default is added to every token. This policy cannot be deleted, but it can be modified (including to an empty policy). There are three endpoints allowed in the default default policy, related to token self-management: lookup-self, which allows a token to retrieve its own information, and revoke-self and renew-self, which are self-explanatory. If your existing Vault installation contains a policy called default, it will not be overridden, but it will be added to each new token created. You can override this behavior when using manual token creation (i.e. not via an authentication backend) by setting the "no_default_policy" flag to true. [GH-732]

IMPROVEMENTS:

• api: API client now uses a 60 second timeout instead of indefinite [GH-681]
• api: Implement LookupSelf, RenewSelf, and RevokeSelf functions for auth tokens [GH-739]
• api: Standardize environment variable reading logic inside the API; the CLI now uses this but can still override via command-line parameters [GH-618]
• audit: HMAC-SHA256'd client tokens are now stored with each request entry. Previously they were only displayed at creation time; this allows much better traceability of client actions. [GH-713]
• audit: There is now a sys/audit-hash endpoint that can be used to generate an HMAC-SHA256'd value from provided data using the given audit backend's salt [GH-784]
• core: The physical storage read cache can now be disabled via "disable_cache" [GH-674]
• core: The unsealing process can now be reset midway through (this feature was documented before, but not enabled) [GH-695]
• core: Tokens can now renew themselves [GH-455]
• core: Base64-encoded PGP keys can be used with the CLI for init and rekey operations [GH-653]
• core: Print version on startup [GH-765]
• core: Access to sys/policy and sys/mounts now uses the normal ACL system instead of requiring a root token [GH-769]
• credential/token: Display whether or not a token is an orphan in the output of a lookup call [GH-766]
• logical: Allow . in path-based variables in many more locations [GH-244]
• logical: Responses now contain a "warnings" key containing a list of warnings returned from the server. These are conditions that did not require failing an operation, but of which the client should be aware. [GH-676]
• physical/(consul,etcd): Consul and etcd now use a connection pool to limit the number of outstanding operations, improving behavior when a lot of operations must happen at once [GH-677] [GH-780]
• physical/consul: The datacenter parameter was removed; It could not be effective unless the Vault node (or the Consul node it was connecting to) was in the datacenter specified, in which case it wasn't needed [GH-816]
• physical/etcd: Support TLS-encrypted connections and use a connection pool to limit the number of outstanding operations [GH-780]
• physical/s3: The S3 endpoint can now be configured, allowing using S3-API-compatible storage solutions [GH-750]
• physical/s3: The S3 bucket can now be configured with the AWS_S3_BUCKET environment variable [GH-758]
• secret/consul: Management tokens can now be created [GH-714]

BUG FIXES:

• api: API client now checks for a 301 response for redirects. Vault doesn't generate these, but in certain conditions Go's internal HTTP handler can generate them, leading to client errors.
• cli: token-create now supports the ttl parameter in addition to the deprecated lease parameter. [GH-688]
• core: Return data from generic backends on the last use of a limited-use token [GH-615]
• core: Fix upgrade path for leases created in generic prior to 0.3 [GH-673]
• core: Stale leader entries will now be reaped [GH-679]
• core: Using mount-tune on the auth/token path did not take effect. [GH-688]
• core: Fix a potential race condition when (un)sealing the vault with metrics enabled [GH-694]
• core: Fix an error that could happen in some failure scenarios where Vault could fail to revert to a clean state [GH-733]
• core: Ensure secondary indexes are removed when a lease is expired [GH-749]
• core: Ensure rollback manager uses an up-to-date mounts table [GH-771]
• everywhere: Don't use http.DefaultClient, as it shares state implicitly and is a source of hard-to-track-down bugs [GH-700]
• credential/token: Allow creating orphan tokens via an API path [GH-748]
• secret/generic: Validate given duration at write time, not just read time; if stored durations are not parseable, return a warning and the default duration rather than an error [GH-718]
• secret/generic: Return 400 instead of 500 when generic backend is written to with no data fields [GH-825]
• secret/postgresql: Revoke permissions before dropping a user or revocation may fail [GH-699]

MISC:

• Various documentation fixes and improvements [GH-685] [GH-688] [GH-697] [GH-710] [GH-715] [GH-831]

0.3.1 (October 6, 2015)

SECURITY:

• core: In certain failure scenarios, the full values of requests and responses would be logged [GH-665]

FEATURES:

• Settable Maximum Open Connections: The mysql and postgresql backends now allow setting the number of maximum open connections to the database, which was previously capped to 2. [GH-661]
• Renewable Tokens for GitHub: The github backend now supports specifying a TTL, enabling renewable tokens. [GH-664]

BUG FIXES:

• dist: linux-amd64 distribution was dynamically linked [GH-656]
• credential/github: Fix acceptance tests [GH-651]

MISC:

• Various minor documentation fixes and improvements [GH-649] [GH-650] [GH-654] [GH-663]

0.3.0 (September 28, 2015)

DEPRECATIONS/BREAKING CHANGES:

Note: deprecations and breaking changes in upcoming releases are announced ahead of time on the "vault-tool" mailing list.

• Cookie Authentication Removed: As of 0.3 the only way to authenticate is via the X-Vault-Token header. Cookie authentication was hard to properly test, could result in browsers/tools/applications saving tokens in plaintext on disk, and other issues. [GH-564]
• Terminology/Field Names: Vault is transitioning from overloading the term "lease" to mean both "a set of metadata" and "the amount of time the metadata is valid". The latter is now being referred to as TTL (or "lease_duration" for backwards-compatibility); some parts of Vault have already switched to using "ttl" and others will follow in upcoming releases. In particular, the "token", "generic", and "pki" backends accept both "ttl" and "lease" but in 0.4 only "ttl" will be accepted. [GH-528]
• Downgrade Not Supported: Due to enhancements in the storage subsytem, values written by Vault 0.3+ will not be able to be read by prior versions of Vault. There are no expected upgrade issues, however, as with all critical infrastructure it is recommended to back up Vault's physical storage before upgrading.

FEATURES:

• SSH Backend: Vault can now be used to delegate SSH access to machines, via a (recommended) One-Time Password approach or by issuing dynamic keys. [GH-385]
• Cubbyhole Backend: This backend works similarly to the "generic" backend but provides a per-token workspace. This enables some additional authentication workflows (especially for containers) and can be useful to applications to e.g. store local credentials while being restarted or upgraded, rather than persisting to disk. [GH-612]
• Transit Backend Improvements: The transit backend now allows key rotation and datakey generation. For rotation, data encrypted with previous versions of the keys can still be decrypted, down to a (configurable) minimum previous version; there is a rewrap function for manual upgrades of ciphertext to newer versions. Additionally, the backend now allows generating and returning high-entropy keys of a configurable bitsize suitable for AES and other functions; this is returned wrapped by a named key, or optionally both wrapped and plaintext for immediate use. [GH-626]
• Global and Per-Mount Default/Max TTL Support: You can now set the default and maximum Time To Live for leases both globally and per-mount. Per-mount settings override global settings. Not all backends honor these settings yet, but the maximum is a hard limit enforced outside the backend. See the documentation for "/sys/mounts/" for details on configuring per-mount TTLs. [GH-469]
• PGP Encryption for Unseal Keys: When initializing or rotating Vault's master key, PGP/GPG public keys can now be provided. The output keys will be encrypted with the given keys, in order. [GH-570]
• Duo Multifactor Authentication Support: Backends that support MFA can now use Duo as the mechanism. [GH-464]
• Performance Improvements: Users of the "generic" backend will see a significant performance improvement as the backend no longer creates leases, although it does return TTLs (global/mount default, or set per-item) as before. [GH-631]
• Codebase Audit: Vault's codebase was audited by iSEC. (The terms of the audit contract do not allow us to make the results public.) [GH-220]

IMPROVEMENTS:

• audit: Log entries now contain a time field [GH-495]
• audit: Obfuscated audit entries now use hmac-sha256 instead of sha1 [GH-627]
• backends: Add ability for a cleanup function to be called on backend unmount [GH-608]
• config: Allow specifying minimum acceptable TLS version [GH-447]
• core: If trying to mount in a location that is already mounted, be more helpful about the error [GH-510]
• core: Be more explicit on failure if the issue is invalid JSON [GH-553]
• core: Tokens can now revoke themselves [GH-620]
• credential/app-id: Give a more specific error when sending a duplicate POST to sys/auth/app-id [GH-392]
• credential/github: Support custom API endpoints (e.g. for Github Enterprise) [GH-572]
• credential/ldap: Add per-user policies and option to login with userPrincipalName [GH-420]
• credential/token: Allow root tokens to specify the ID of a token being created from CLI [GH-502]
• credential/userpass: Enable renewals for login tokens [GH-623]
• scripts: Use /usr/bin/env to find Bash instead of hardcoding [GH-446]
• scripts: Use godep for build scripts to use same environment as tests [GH-404]
• secret/mysql: Allow reading configuration data [GH-529]
• secret/pki: Split "allow_any_name" logic to that and "enforce_hostnames", to allow for non-hostname values (e.g. for client certificates) [GH-555]
• storage/consul: Allow specifying certificates used to talk to Consul [GH-384]
• storage/mysql: Allow SSL encrypted connections [GH-439]
• storage/s3: Allow using temporary security credentials [GH-433]
• telemetry: Put telemetry object in configuration to allow more flexibility [GH-419]
• testing: Disable mlock for testing of logical backends so as not to require root [GH-479]

BUG FIXES:

• audit/file: Do not enable auditing if file permissions are invalid [GH-550]
• backends: Allow hyphens in endpoint patterns (fixes AWS and others) [GH-559]
• cli: Fixed missing setup of client TLS certificates if no custom CA was provided
• cli/read: Do not include a carriage return when using raw field output [GH-624]
• core: Bad input data could lead to a panic for that session, rather than returning an error [GH-503]
• core: Allow SHA2-384/SHA2-512 hashed certificates [GH-448]
• core: Do not return a Secret if there are no uses left on a token (since it will be unable to be used) [GH-615]
• core: Code paths that called lookup-self would decrement num_uses and potentially immediately revoke a token [GH-552]
• core: Some /sys/ paths would not properly redirect from a standby to the leader [GH-499] [GH-551]
• credential/aws: Translate spaces in a token's display name to avoid making IAM unhappy [GH-567]
• credential/github: Integration failed if more than ten organizations or teams [GH-489]
• credential/token: Tokens with sudo access to "auth/token/create" can now use root-only options [GH-629]
• secret/cassandra: Work around backwards-incompatible change made in Cassandra 2.2 preventing Vault from properly setting/revoking leases [GH-549]
• secret/mysql: Use varbinary instead of varchar to avoid InnoDB/UTF-8 issues [GH-522]
• secret/postgres: Explicitly set timezone in connections [GH-597]
• storage/etcd: Renew semaphore periodically to prevent leadership flapping [GH-606]
• storage/zk: Fix collisions in storage that could lead to data unavailability [GH-411]

MISC:

• Various documentation fixes and improvements [GH-412] [GH-474] [GH-476] [GH-482] [GH-483] [GH-486] [GH-508] [GH-568] [GH-574] [GH-586] [GH-590] [GH-591] [GH-592] [GH-595] [GH-613] [GH-637]
• Less "armon" in stack traces [GH-453]
• Sourcegraph integration [GH-456]

0.2.0 (July 13, 2015)

FEATURES:

• Key Rotation Support: The rotate command can be used to rotate the master encryption key used to write data to the storage (physical) backend. [GH-277]
• Rekey Support: Rekey can be used to rotate the master key and change the configuration of the unseal keys (number of shares, threshold required). [GH-277]
• New secret backend: pki: Enable Vault to be a certificate authority and generate signed TLS certificates. [GH-310]
• New secret backend: cassandra: Generate dynamic credentials for Cassandra [GH-363]
• New storage backend: etcd: store physical data in etcd [GH-259] [GH-297]
• New storage backend: s3: store physical data in S3. Does not support HA. [GH-242]
• New storage backend: MySQL: store physical data in MySQL. Does not support HA. [GH-324]
• transit secret backend supports derived keys for per-transaction unique keys [GH-399]

IMPROVEMENTS:

• cli/auth: Enable cert method [GH-380]
• cli/auth: read input from stdin [GH-250]
• cli/read: Ability to read a single field from a secret [GH-257]
• cli/write: Adding a force flag when no input required
• core: allow time duration format in place of seconds for some inputs
• core: audit log provides more useful information [GH-360]
• core: graceful shutdown for faster HA failover
• core: change policy format to use explicit globbing [GH-400] Any existing policy in Vault is automatically upgraded to avoid issues. All policy files must be updated for future writes. Adding the explicit glob character * to the path specification is all that is required.
• core: policy merging to give deny highest precedence [GH-400]
• credential/app-id: Protect against timing attack on app-id
• credential/cert: Record the common name in the metadata [GH-342]
• credential/ldap: Allow TLS verification to be disabled [GH-372]
• credential/ldap: More flexible names allowed [GH-245] [GH-379] [GH-367]
• credential/userpass: Protect against timing attack on password
• credential/userpass: Use bcrypt for password matching
• http: response codes improved to reflect error [GH-366]
• http: the sys/health endpoint supports ?standbyok to return 200 on standby [GH-389]
• secret/app-id: Support deleting AppID and UserIDs [GH-200]
• secret/consul: Fine grained lease control [GH-261]
• secret/transit: Decouple raw key from key management endpoint [GH-355]
• secret/transit: Upsert named key when encrypt is used [GH-355]
• storage/zk: Support for HA configuration [GH-252]
• storage/zk: Changing node representation. Backwards incompatible. [GH-416]

BUG FIXES:

• audit/file: file removing TLS connection state
• audit/syslog: fix removing TLS connection state
• command/*: commands accepting k=v allow blank values
• core: Allow building on FreeBSD [GH-365]
• core: Fixed various panics when audit logging enabled
• core: Lease renewal does not create redundant lease
• core: fixed leases with negative duration [GH-354]
• core: token renewal does not create child token
• core: fixing panic when lease increment is null [GH-408]
• credential/app-id: Salt the paths in storage backend to avoid information leak
• credential/cert: Fixing client certificate not being requested
• credential/cert: Fixing panic when no certificate match found [GH-361]
• http: Accept PUT as POST for sys/auth
• http: Accept PUT as POST for sys/mounts [GH-349]
• http: Return 503 when sealed [GH-225]
• secret/postgres: Username length is capped to exceeding limit
• server: Do not panic if backend not configured [GH-222]
• server: Explicitly check value of tls_diable [GH-201]
• storage/zk: Fixed issues with version conflicts [GH-190]

MISC:

• cli/path-help: renamed from help to avoid confusion

0.1.2 (May 11, 2015)

FEATURES:

• New physical backend: zookeeper: store physical data in Zookeeper. HA not supported yet.
• New credential backend: ldap: authenticate using LDAP credentials.

IMPROVEMENTS:

• core: Auth backends can store internal data about auth creds
• audit: display name for auth is shown in logs [GH-176]
• command/*: -insecure has been renamed to -tls-skip-verify [GH-130]
• command/*: VAULT_TOKEN overrides local stored auth [GH-162]
• command/server: environment variables are copy-pastable
• credential/app-id: hash of app and user ID are in metadata [GH-176]
• http: HTTP API accepts X-Vault-Token as auth header [GH-124]
• logical/*: Generate help output even if no synopsis specified

BUG FIXES:

• core: login endpoints should never return secrets
• core: Internal data should never be returned from core endpoints
• core: defer barrier initialization to as late as possible to avoid error cases during init that corrupt data (no data loss)
• core: guard against invalid init config earlier
• audit/file: create file if it doesn't exist [GH-148]
• command/*: ignore directories when traversing CA paths [GH-181]
• credential/*: all policy mapping keys are case insensitive [GH-163]
• physical/consul: Fixing path for locking so HA works in every case

0.1.1 (May 2, 2015)

SECURITY CHANGES:

• physical/file: create the storge with 0600 permissions [GH-102]
• token/disk: write the token to disk with 0600 perms

IMPROVEMENTS:

• core: Very verbose error if mlock fails [GH-59]
• command/*: On error with TLS oversized record, show more human-friendly error message. [GH-123]
• command/read: lease_renewable is now outputed along with the secret to show whether it is renewable or not
• command/server: Add configuration option to disable mlock
• command/server: Disable mlock for dev mode so it works on more systems

BUG FIXES:

• core: if token helper isn't absolute, prepend with path to Vault executable, not "vault" (which requires PATH) [GH-60]
• core: Any "mapping" routes allow hyphens in keys [GH-119]
• core: Validate advertise_addr is a valid URL with scheme [GH-106]
• command/auth: Using an invalid token won't crash [GH-75]
• credential/app-id: app and user IDs can have hyphens in keys [GH-119]
• helper/password: import proper DLL for Windows to ask password [GH-83]

0.1.0 (April 28, 2015)

• Initial release