In this lesson, you will learn how to bridge Linux authentication with HashiCorp Vault to dynamically inject secrets into a user's environment upon login.
Bridging PAM and HashiCorp Vault
When managing secrets at scale, storing database credentials or API tokens in static configuration files is a security liability. Instead, we can use the pam_exec.so module to interface with HashiCorp Vault, retrieving ephemeral credentials exactly when a user logs in. By doing this, the secret exists only in the user’s memory space for the duration of their session.
How it works
The pam_exec module allows you to run an external script during the session phase of authentication. When a user authenticates, PAM triggers a script that performs the following:
- Authentication: The script uses the user’s existing credentials (or a pre-configured service token) to authenticate against Vault.
- Dynamic Generation: It requests a short-lived secret (such as a database role) from the Vault secrets engine.
- Environment Injection: The script outputs the credentials in a format the user’s shell can consume, or writes them to a temporary, memory-backed file (
tmpfs) that the user’s profile sources.
Example Configuration
To integrate this, you add a line to your /etc/pam.d/sshd file:
session optional pam_exec.so expose_authtok /usr/local/bin/fetch-vault-secrets.sh
Inside your fetch-vault-secrets.sh script, you would interact with the Vault API using curl or the vault binary:
#!/bin/bash
# Fetch dynamic database creds for the authenticated user
SECRET=$(vault read -field=data database/creds/my-role)
export DB_PASSWORD=$SECRET
By setting the credentials as environment variables during the session phase, you ensure that the secret is never written to disk, is specific to the current session, and is revoked automatically by Vault once the time-to-live (TTL) expires. This creates a "Just-in-Time" secret delivery pipeline that scales with your user base and removes the burden of manual credential rotation.
Key Takeaway: Integrating PAM with HashiCorp Vault allows you to transform static credentials into dynamic, session-bound secrets that are injected securely at the moment of login.