132 lines
2.6 KiB
Markdown
132 lines
2.6 KiB
Markdown
# local-mini-kms
|
|
|
|
Mini-KMS runs local written by Rust
|
|
|
|
## Build
|
|
|
|
```shell
|
|
cargo build --release [--no-default-features]
|
|
```
|
|
|
|
## Init
|
|
|
|
New random master key:
|
|
|
|
```shell
|
|
head -c 32 /dev/random | base64
|
|
```
|
|
|
|
## Generate Yubikey encrypted master key
|
|
|
|
Generate encrypted master key with Yubikey:
|
|
|
|
```shell
|
|
local-mini-kms yubikey-init-master-key --generate-key [--yubikey-challenge *challenge*]
|
|
```
|
|
|
|
## Startup Server
|
|
|
|
Startup without init:
|
|
|
|
```shell
|
|
local-mini-kms serve
|
|
```
|
|
|
|
Init with Yubikey:
|
|
|
|
```shell
|
|
local-mini-kms serve [--init-encrypted-master-key LKMS:*** [--yubikey-challenge *challenge*]]
|
|
```
|
|
|
|
## Local Client init via SSH
|
|
|
|
```shell
|
|
local-mini-kms cli --init --ssh-remote root@example.com [--read-from-pinentry]
|
|
```
|
|
|
|
## Local Client
|
|
|
|
```shell
|
|
local-mini-kms cli --init
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --offline-init
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --direct-init --value-base64 wNdr9sZN4**** [--yubikey-challenge *challenge*]
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --encrypt --value hello
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --decrypt --value LKMS:***
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --read --name test
|
|
```
|
|
|
|
```shell
|
|
local-mini-kms cli --write --name test --value hello [--force-write] [--comment *comment*]
|
|
```
|
|
|
|
## cURL
|
|
|
|
Write value:
|
|
|
|
```shell
|
|
curl -X POST http://127.0.0.1:5567/write \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"name":"test","value":{"value":"hello"}}'
|
|
```
|
|
|
|
Read value:
|
|
|
|
```shell
|
|
curl -X POST http://127.0.0.1:5567/read \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"name":"test"}'
|
|
```
|
|
|
|
Generate data key:
|
|
|
|
```shell
|
|
curl -X POST http://127.0.0.1:5567/datakey \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"type":"aes", "spec":"256", "exportable": true, "return_plaintext": true, "name": "key001", "comment": "the comment"}'
|
|
```
|
|
|
|
```shell
|
|
xh POST http://127.0.0.1:5567/datakey \
|
|
type=aes \
|
|
spec=256 \
|
|
exportable:=false \
|
|
name=testkey01 \
|
|
comment='this is a test key 01'
|
|
```
|
|
|
|
```shell
|
|
xh POST http://127.0.0.1:5567/list type=value name=name limit:=10
|
|
```
|
|
|
|
| Key | Comment |
|
|
|------------------|------------------------------------------------------|
|
|
| type | `aes` |
|
|
| spec | ~~`128`, `192`,~~ `256` if `type` == `aes` |
|
|
| exportable | <i>[optional]</i> `true` or `false` , default `true` |
|
|
| return_plaintext | <i>[optional]</i> `true` or `false`, default `false` |
|
|
| name | <i>[optional]</i> Data key name |
|
|
| comment | <i>[optional]</i> Data key comment |
|
|
|
|
Upgrade to v3.2
|
|
|
|
```sql
|
|
ALTER TABLE keys
|
|
ADD COLUMN comment TEXT;
|
|
```
|
|
|