How can I understand something from hashicorp vault audit? - security

Question

I'm trying to get familiar with Hashicorp Vault and I don't understand how to use its audit log?
For example, let's say, one of the admins was compromised and somebody with root-token created another one root-token. I'm getting an audit log like this:
{
"time": "2019-08-17T21:53:07.625384189Z",
"type": "request",
"auth": {
"client_token": "hmac-sha256:0c97855631748ce0a775e3efc79fc607b0d2f61ddeb78b15e915a5087013fb5b",
"accessor": "hmac-sha256:c081cc37603419f02e67fb93f2f1362aa0eb37fa42635606cc51b9b7ed1ed561",
"display_name": "root",
"policies": [
"root"
],
"token_policies": [
"root"
],
"token_type": "service"
},
"request": {
"id": "f8b0f707-7e38-1410-4173-235ff9e250b6",
"operation": "update",
"client_token": "hmac-sha256:0c97855631748ce0a775e3efc79fc607b0d2f61ddeb78b15e915a5087013fb5b",
"client_token_accessor": "hmac-sha256:c081cc37603419f02e67fb93f2f1362aa0eb37fa42635606cc51b9b7ed1ed561",
"namespace": {
"id": "root"
},
"path": "auth/token/create",
"data": {
"display_name": "hmac-sha256:0f235cb7061e26e25b346c787a036860e247e0e32181b8adf13850812a27a9f1",
"entity_alias": "hmac-sha256:0f235cb7061e26e25b346c787a036860e247e0e32181b8adf13850812a27a9f1",
"explicit_max_ttl": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"num_uses": "hmac-sha256:943213e389eae841e8d03f94149bc8e564973fd4c6f0eabe76061dd4355b03b0",
"period": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"renewable": true,
"ttl": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"type": "hmac-sha256:792572c378bcb0b0400ad2033078e80334dfd06d76d948866960ad9b8547ba62"
},
"remote_address": "127.0.0.1"
}
}
{
"time": "2019-08-17T21:53:07.709275872Z",
"type": "response",
"auth": {
"client_token": "hmac-sha256:0c97855631748ce0a775e3efc79fc607b0d2f61ddeb78b15e915a5087013fb5b",
"accessor": "hmac-sha256:c081cc37603419f02e67fb93f2f1362aa0eb37fa42635606cc51b9b7ed1ed561",
"display_name": "root",
"policies": [
"root"
],
"token_policies": [
"root"
],
"token_type": "service"
},
"request": {
"id": "f8b0f707-7e38-1410-4173-235ff9e250b6",
"operation": "update",
"client_token": "hmac-sha256:0c97855631748ce0a775e3efc79fc607b0d2f61ddeb78b15e915a5087013fb5b",
"client_token_accessor": "hmac-sha256:c081cc37603419f02e67fb93f2f1362aa0eb37fa42635606cc51b9b7ed1ed561",
"namespace": {
"id": "root"
},
"path": "auth/token/create",
"data": {
"display_name": "hmac-sha256:0f235cb7061e26e25b346c787a036860e247e0e32181b8adf13850812a27a9f1",
"entity_alias": "hmac-sha256:0f235cb7061e26e25b346c787a036860e247e0e32181b8adf13850812a27a9f1",
"explicit_max_ttl": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"num_uses": "hmac-sha256:943213e389eae841e8d03f94149bc8e564973fd4c6f0eabe76061dd4355b03b0",
"period": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"renewable": true,
"ttl": "hmac-sha256:3cf83aa363c8f73a7e23ccd56baa8f4e1119bc15800030f663f2d07c5420ce91",
"type": "hmac-sha256:792572c378bcb0b0400ad2033078e80334dfd06d76d948866960ad9b8547ba62"
},
"remote_address": "127.0.0.1"
},
"response": {
"auth": {
"client_token": "hmac-sha256:fdb305fbabaf0044fc6d696fb2d0ff3d96574ff4d7fab804e8d5d36b7f2ddd14",
"accessor": "hmac-sha256:19f3a70ceea337f067c053249504fbf8e8c164304b66a8c97fad421d43b5e4af",
"display_name": "token",
"policies": [
"root"
],
"token_policies": [
"root"
],
"token_type": "service"
}
}
}
How can I find out who it was?
How can I get the accessor of the token that was compromised?
Where can I get an accessor of the just created token to revoke it?
Or maybe I didn't get purposes of the Vault audit right?

Answer 1

I've found a cool option that hepled me: hmac_accessor = false, here is the audit log with tis option enabled:
{
"time": "2019-08-27T07:55:57.888464574Z",
"type": "response",
"auth": {
"client_token": "hmac-sha256:84c8887e815c04aeef145ebffa05f9ef6fde166d7645b5046416d76add283fef",
"accessor": "y1lRcyzxkPgL0gmQ45WqliPy",
"display_name": "root",
...
},
"request": {
"id": "f4dc76af-b562-ae2c-8d6f-dd6a0d6f7ef6",
"operation": "update",
"client_token": "hmac-sha256:84c8887e815c04aeef145ebffa05f9ef6fde166d7645b5046416d76add283fef",
"client_token_accessor": "y1lRcyzxkPgL0gmQ45WqliPy",
...
},
"response": {
...
},
"error": ""
}
UPD: list of current accessors:
$ vault list auth/token/accessors
Keys
----
MelMLthx4K4FznCbNIB8xbC6
bOnatDe7MXfdB9f3CRuGPo0h
y1lRcyzxkPgL0gmQ45WqliPy
VerAvaBln92HG38gKbKEcXOZ
Get info about token by the accessor:
$ vault write auth/token/lookup-accessor accessor=VerAvaBln92HG38gKbKEcXOZ
Key Value
--- -----
accessor VerAvaBln92HG38gKbKEcXOZ
creation_time 1566893336
creation_ttl 3m
display_name token
entity_id n/a
expire_time 2019-08-27T11:11:56.903211142+03:00
explicit_max_ttl 0s
id n/a
issue_time 2019-08-27T11:08:56.903210949+03:00
meta <nil>
num_uses 0
orphan false
path auth/token/create
period 3m
policies [root]
renewable true
ttl 2m55s
type service