Run Vault on Raspberry Pi and Unseal with Hardware!
summary
Runs Vault as a systemd service on a Raspberry Pi 3B, initializes Vault and prints the root token, then stores split unseal material in local files and uses a USB fingerprint scanner to enroll a finger and perform an automated unseal; demo reseals on restart and can unseal again but fingerprint recognition is flaky. A second demo uses three RFID tags to hold unseal shares (reads tags from GPIO), notes duplicate UIDs and no on-card encryption, and shares scripts but marks this experimental, not production.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 1:05What is Raspberry Pi
- 8:09Speaker introduction
- 10:37Why this project
- 12:47Important warnings
- 13:32Demo overview
- 14:15Fingerprint unseal demo
- 19:14RFID unseal demo
- 23:35Resources and links
- 24:39Q&A
related talks
27mKeybase Vault Auto-Unseal
35mOops, I committed my private key: Automating security from with IoT and IaC
41mHiding secrets in a Vault
33mRuntime Protection for Vault & Consul
31mBuilding a Repeatable and Hardened Vault POC
40mA Better Way To Manage Secrets
29mIntro to secrets management using Vault
51mIntroduction to Vault