OpenBao is an identity-based secrets and encryption management system. A secret is anything that you want to tightly control access to, such as API encryption keys, passwords, and certificates. OpenBao provides encryption services that are gated by authentication and authorization methods. Using OpenBao’s UI, CLI, or HTTP API, access to secrets and other sensitive data can be securely stored and managed, tightly controlled (restricted), and auditable.
A modern system requires access to a multitude of secrets, including database credentials, API keys for external services, credentials for service-oriented architecture communication, etc. It can be difficult to understand who is accessing which secrets, especially since this can be platform-specific. Adding on key rolling, secure storage, and detailed audit logs is almost impossible without a custom solution. This is where OpenBao steps in.
OpenBao validates and authorizes clients (users, machines, apps) before providing them access to secrets or stored sensitive data.
OpenBao is an open source, community-driven fork of Vault managed by the Linux Foundation.
Key Features
- Secure Secret Storage: Arbitrary key/value secrets can be stored in OpenBao. OpenBao encrypts these secrets prior to writing them to persistent storage, so gaining access to the raw storage isn’t enough to access your secrets.
- Dynamic Secrets: OpenBao can generate secrets on-demand for some systems, such as Kubernetes or SQL databases. For example, when an application needs to access a Kubernetes cluster, it asks OpenBao for credentials, and OpenBao will generate an Kubernetes service account token with valid permissions on demand. After creating these dynamic secrets, OpenBao will also automatically revoke them after the lease is up.
- Data Encryption: OpenBao can encrypt and decrypt data without storing it. This allows security teams to define encryption parameters and developers to store encrypted data in a location such as a SQL database without having to design their own encryption methods.
- Leasing and Renewal: All secrets in OpenBao have a lease associated with them. At the end of the lease, OpenBao will automatically revoke that secret. Clients are able to renew leases via built-in renew APIs.
- Revocation: OpenBao has built-in support for secret revocation. OpenBao can revoke not only single secrets, but a tree of secrets, for example all secrets read by a specific user, or all secrets of a particular type. Revocation assists in key rolling as well as locking down systems in the case of an intrusion.
Website: github.com/openbao/openbao
Support:
Developer: Linux Foundation
License: Mozilla Public License 2.0
OpenBao is written in Go and JavaScript. Learn Go with our recommended free books and free tutorials. Learn JavaScript with our recommended free books and free tutorials.
Related Software
| Secrets Management | |
|---|---|
| OpenBao | Manage, store, and distribute sensitive data |
| SOPS | Editor of encrypted files |
| Sealed Secrets | One-way encrypted secrets |
| Vault | Tool for securely accessing secrets |
| Infisical | Secrets management, PKI, and SSH access |
| fnox | Encrypted/remote secret manager |
| Envy | Slick TUI for browsing secrets and a CLI for automation |
| Chamber | Modern secret management solution |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |