一、深入了解安全工具Vault
Vault是一种开源工具，用于安全地存储、管理和控制访问各种机密信息，如密码、API令牌、安全配置和其他敏感数据。Vault使用强大的加密和安全管理技术来保护这些机密信息，并为应用程序和服务提供安全的访问控制机制。该工具支持各种云平台和技术堆栈，并提供多种API和CLI接口，使其易于集成和使用。Vault的主要特点包括中心化管理、角色分配和权限控制、审计和日志记录、动态秘钥持续更新等。这些功能使得Vault成为一款颇受开发者和企业信赖的安全工具。
二、Vault根令牌和解封密钥的含义和作用
Vault 中的根令牌和解封密钥是用于管理和保护 Vault 中加密数据的重要凭据。
根令牌是 Vault 中的最高权限凭据，拥有此令牌的用户可以在 Vault 中进行任何操作，包括创建和删除机密、管理策略、配置身份验证等。因此，根令牌需要严格保密，并只在必要时进行使用。
解封密钥则是用于解密 Vault 中加密数据的重要凭据，可以用于解密 Vault 的存储密钥，解密后可以访问存储在 Vault 中的机密信息。因此，解封密钥也需要严格保密，通常会将其存储在冷存储中，以防止未经授权的访问和泄露。只有在必要时才使用解封密钥，例如在进行恢复操作或在创建新的存储密钥时。
三、centos7上部署和启动Vault的流程
在CentOS 7上部署和启动Vault可以按照以下步骤进行：
下载Vault二进制文件：可以从官网下载，也可以使用wget命令从Vault的GitHub页面下载。
安装Vault：将Vault二进制文件移到/usr/local/bin目录下，并添加执行权限。
配置Vault：可以在/etc目录下创建一个Vault配置文件，指定Vault的监听地址和端口，以及存储Vault数据的路径。
启动Vault：使用vault server命令启动Vault服务，会自动读取/etc目录下的配置文件并启动服务。
初始化Vault：使用vault init命令初始化Vault，生成一组Root Token和Unseal Key。
解封Vault：使用vault unseal命令输入Unseal Key解封Vault服务。
登录Vault：使用vault login命令输入Root Token登录Vault。
四、vault下载地址
vault下载地址：
vault官方下载地址
选择下载的版本
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo yum -y install vault
五、安装vault
执行命令：
sudo yum install -y yum-utils
sudo yum install -y yum-utils
Loaded plugins: fastestmirror, langpacks, priorities, versionlock
Determining fastest mirrors
epel | 4.7 kB 00:00:00
extras | 2.9 kB 00:00:00
hashicorp | 1.4 kB 00:00:00
os | 3.6 kB 00:00:00
pgdg-common/7/x86_64/signature | 198 B 00:00:00
pgdg-common/7/x86_64/signature | 2.9 kB 00:00:00 !!!
pgdg11/7/x86_64/signature | 198 B 00:00:00
pgdg11/7/x86_64/signature | 3.6 kB 00:00:00 !!!
pgdg12/7/x86_64/signature | 198 B 00:00:00
pgdg12/7/x86_64/signature | 3.6 kB 00:00:00 !!!
pgdg13/7/x86_64/signature | 198 B 00:00:00
pgdg13/7/x86_64/signature | 3.6 kB 00:00:00 !!!
pgdg14/7/x86_64/signature | 198 B 00:00:00
pgdg14/7/x86_64/signature | 3.6 kB 00:00:00 !!!
pgdg15/7/x86_64/signature | 198 B 00:00:00
pgdg15/7/x86_64/signature | 3.6 kB 00:00:00 !!!
updates | 2.9 kB 00:00:00
(1/2): pgdg-common/7/x86_64/primary_db | 181 kB 00:00:02
(2/2): hashicorp/7/x86_64/primary | 165 kB 00:00:05
hashicorp 1196/1196
Package yum-utils-1.1.31-54.el7_8.noarch already installed and latest version
Nothing to do
执行命令：sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
Loaded plugins: fastestmirror, langpacks, priorities, versionlock
adding repo from: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
grabbing file https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo to /etc/yum.repos.d/hashicorp.repo
repo saved to /etc/yum.repos.d/hashicorp.repo
执行命令：sudo yum -y install vault
sudo yum -y install vault
Loaded plugins: fastestmirror, langpacks, priorities, versionlock
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package vault.x86_64 0:1.13.3-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
==================================================================================================================================================
Package Arch Version Repository Size
==================================================================================================================================================
Installing:
vault x86_64 1.13.3-1 hashicorp 92 M
Transaction Summary
==================================================================================================================================================
Install 1 Package
Total download size: 92 M
Installed size: 234 M
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
warning: /var/cache/yum/x86_64/7/hashicorp/packages/vault-1.13.3-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID a621e701: NOKEY00:00:00 ETA
Public key for vault-1.13.3-1.x86_64.rpm is not installed
vault-1.13.3-1.x86_64.rpm | 92 MB 00:00:24
Retrieving key from https://rpm.releases.hashicorp.com/gpg
Importing GPG key 0xA621E701:
Userid : "HashiCorp Security (HashiCorp Package Signing) <[email protected]>"
Fingerprint: 798a ec65 4e5c 1542 8c8e 42ee aa16 fcbc a621 e701
From : https://rpm.releases.hashicorp.com/gpg
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : vault-1.13.3-1.x86_64 1/1Generating Vault TLS key and self-signed certificate...
Generating a 4096 bit RSA private key
.......................++
.................................................................................................++
writing new private key to 'tls.key'
-----
Vault TLS key and self-signed certificate have been generated in '/opt/vault/tls'.
Verifying : vault-1.13.3-1.x86_64 1/1
Installed:
vault.x86_64 0:1.13.3-1
Complete!
六、启动Vault
执行启动命令：
vault server -dev -dev-root-token-id=“dev-only-token”
vault server -dev -dev-root-token-id="dev-only-token"
==> Vault server configuration:
Api Address: http://127.0.0.1:8200
Cgo: disabled
Cluster Address: https://127.0.0.1:8201
Environment Variables: CLASSPATH, FLINK_HOME, GODEBUG, HADOOP_HOME, HISTFILE, HISTSIZE, HISTTIMEFORMAT, HIVE_HOME, HOME, HOSTNAME, JAVA_HOME, LANG, LESSOPEN, LOGNAME, LS_COLORS, MAIL, MONGODB_HOME, MSSQL_HOME, PATH, PROMPT_COMMAND, PWD, PYTHON3_HOME, QT_GRAPHICSSYSTEM, QT_GRAPHICSSYSTEM_CHECKED, SHELL, SHLVL, SPARK_HOME, SUDO_COMMAND, SUDO_GID, SUDO_UID, SUDO_USER, TERM, TMOUT, USER, USERNAME, XDG_SESSION_ID, ZOOKEEP_HOME, _
Go Version: go1.20.4
Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
Log Level:
Mlock: supported: true, enabled: false
Recovery Mode: false
Storage: inmem
Version: Vault v1.13.3, built 2023-06-06T18:12:37Z
Version Sha: 3bedf816cbf851656ae9e6bd65dd4a67a9ddff5e
==> Vault server started! Log data will stream in below:
2023-06-19T10:38:19.735+0800 [INFO] proxy environment: http_proxy="" https_proxy="" no_proxy=""
2023-06-19T10:38:19.735+0800 [WARN] no `api_addr` value specified in config or in VAULT_API_ADDR; falling back to detection if possible, but this value should be manually set
2023-06-19T10:38:19.736+0800 [INFO] core: Initializing version history cache for core
2023-06-19T10:38:19.736+0800 [INFO] core: security barrier not initialized
2023-06-19T10:38:19.736+0800 [INFO] core: security barrier initialized: stored=1 shares=1 threshold=1
2023-06-19T10:38:19.737+0800 [INFO] core: post-unseal setup starting
2023-06-19T10:38:19.751+0800 [INFO] core: loaded wrapping token key
2023-06-19T10:38:19.751+0800 [INFO] core: successfully setup plugin catalog: plugin-directory=""
2023-06-19T10:38:19.751+0800 [INFO] core: no mounts; adding default mount table
2023-06-19T10:38:19.753+0800 [INFO] core: successfully mounted: type=cubbyhole version="v1.13.3+builtin.vault" path=cubbyhole/ namespace="ID: root. Path: "
2023-06-19T10:38:19.753+0800 [INFO] core: successfully mounted: type=system version="v1.13.3+builtin.vault" path=sys/ namespace="ID: root. Path: "
2023-06-19T10:38:19.754+0800 [INFO] core: successfully mounted: type=identity version="v1.13.3+builtin.vault" path=identity/ namespace="ID: root. Path: "
2023-06-19T10:38:19.755+0800 [INFO] core: successfully mounted: type=token version="v1.13.3+builtin.vault" path=token/ namespace="ID: root. Path: "
2023-06-19T10:38:19.756+0800 [INFO] rollback: starting rollback manager
2023-06-19T10:38:19.757+0800 [INFO] core: restoring leases
2023-06-19T10:38:19.758+0800 [INFO] expiration: lease restore complete
2023-06-19T10:38:19.758+0800 [INFO] identity: entities restored
2023-06-19T10:38:19.759+0800 [INFO] identity: groups restored
2023-06-19T10:38:19.759+0800 [INFO] core: Recorded vault version: vault version=1.13.3 upgrade time="2023-06-19 02:38:19.759135384 +0000 UTC" build date=2023-06-06T18:12:37Z
2023-06-19T10:38:19.981+0800 [INFO] core: post-unseal setup complete
2023-06-19T10:38:19.981+0800 [INFO] core: root token generated
2023-06-19T10:38:19.981+0800 [INFO] core: pre-seal teardown starting
2023-06-19T10:38:19.981+0800 [INFO] rollback: stopping rollback manager
2023-06-19T10:38:19.982+0800 [INFO] core: pre-seal teardown complete
2023-06-19T10:38:19.982+0800 [INFO] core.cluster-listener.tcp: starting listener: listener_address=127.0.0.1:8201
2023-06-19T10:38:19.982+0800 [INFO] core.cluster-listener: serving cluster requests: cluster_listen_address=127.0.0.1:8201
2023-06-19T10:38:19.982+0800 [INFO] core: post-unseal setup starting
2023-06-19T10:38:19.982+0800 [INFO] core: loaded wrapping token key
2023-06-19T10:38:19.982+0800 [INFO] core: successfully setup plugin catalog: plugin-directory=""
2023-06-19T10:38:19.983+0800 [INFO] core: successfully mounted: type=system version="v1.13.3+builtin.vault" path=sys/ namespace="ID: root. Path: "
2023-06-19T10:38:19.983+0800 [INFO] core: successfully mounted: type=identity version="v1.13.3+builtin.vault" path=identity/ namespace="ID: root. Path: "
2023-06-19T10:38:19.983+0800 [INFO] core: successfully mounted: type=cubbyhole version="v1.13.3+builtin.vault" path=cubbyhole/ namespace="ID: root. Path: "
2023-06-19T10:38:19.984+0800 [INFO] core: successfully mounted: type=token version="v1.13.3+builtin.vault" path=token/ namespace="ID: root. Path: "
2023-06-19T10:38:19.984+0800 [INFO] rollback: starting rollback manager
2023-06-19T10:38:19.984+0800 [INFO] core: restoring leases
2023-06-19T10:38:19.985+0800 [INFO] identity: entities restored
2023-06-19T10:38:19.985+0800 [INFO] identity: groups restored
2023-06-19T10:38:19.985+0800 [INFO] expiration: lease restore complete
2023-06-19T10:38:19.985+0800 [INFO] core: post-unseal setup complete
2023-06-19T10:38:19.985+0800 [INFO] core: vault is unsealed
2023-06-19T10:38:19.987+0800 [INFO] expiration: revoked lease: lease_id=auth/token/root/h272562f04a210e20b2b4d865e2a84db2d53929c149d30e4e06dcd93ebe88dbac
2023-06-19T10:38:19.989+0800 [INFO] core: successful mount: namespace="" path=secret/ type=kv version=""
WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
and starts unsealed with a single unseal key. The root token is already
authenticated to the CLI, so you can immediately begin using Vault.
You may need to set the following environment variables:
$ export VAULT_ADDR='http://127.0.0.1:8200'
The unseal key and root token are displayed below in case you want to
seal/unseal the Vault or re-authenticate.
Unseal Key: DY/t5B7OSPzH1XZq5RJoEr0o7l4Ea5epNl9h0b/zaF4=
Root Token: dev-only-token
Development mode should NOT be used in production installations!
如上所示，成功启动Vault，至此成功安装部署Vault
注意命令行输出的解封密钥和根令牌，要妥善保存解封密钥和根令牌：
Unseal Key: DY/t5B7OSPzH1XZq5RJoEr0o7l4Ea5epNl9h0b/zaF4=
Root Token: dev-only-token
[root@mcw02 ~]# curl https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo -o /etc/yum.
yum.conf yum.repos.d/
[root@mcw02 ~]# curl https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo -o /etc/yum.repos.d/hashicorp.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 381 100 381 0 0 54 0 0:00:07 0:00:06 0:00:01 86
[root@mcw02 ~]# yum -y install vault
Loaded plugins: fastestmirror
base | 3.6 kB 00:00:00
epel | 4.3 kB 00:00:00
extras | 2.9 kB 00:00:00
glusterfs | 2.9 kB 00:00:00
hashicorp | 1.4 kB 00:00:00
salt-3004-repo | 2.9 kB 00:00:00
selfmcw | 2.9 kB 00:00:00
updates | 2.9 kB 00:00:00
zabbix | 2.9 kB 00:00:00
zabbix-non-supported | 2.9 kB 00:00:00
(1/6): epel/x86_64/group | 399 kB 00:00:00
(2/6): extras/7/x86_64/primary_db | 253 kB 00:00:00
(3/6): epel/x86_64/updateinfo | 1.0 MB 00:00:01
(4/6): hashicorp/7/x86_64/primary | 243 kB 00:00:01
(5/6): epel/x86_64/primary_db | 8.7 MB 00:00:10
(6/6): updates/7/x86_64/primary_db | 27 MB 00:00:33
Determining fastest mirrors
* base: mirrors.aliyun.com
* extras: mirrors.aliyun.com
* updates: mirrors.aliyun.com
hashicorp 1762/1762
Resolving Dependencies
--> Running transaction check
---> Package vault.x86_64 0:1.16.2-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=======================================================================================================================================================================
Package Arch Version Repository Size
=======================================================================================================================================================================
Installing:
vault x86_64 1.16.2-1 hashicorp 143 M
Transaction Summary
=======================================================================================================================================================================
Install 1 Package
Total download size: 143 M
Installed size: 402 M
Downloading packages:
warning: /var/cache/yum/x86_64/7/hashicorp/packages/vault-1.16.2-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID a621e701: NOKEY] 7.2 MB/s | 141 MB 00:00:00 ETA
Public key for vault-1.16.2-1.x86_64.rpm is not installed
vault-1.16.2-1.x86_64.rpm | 143 MB 00:00:25
Retrieving key from https://rpm.releases.hashicorp.com/gpg
Importing GPG key 0xA621E701:
Userid : "HashiCorp Security (HashiCorp Package Signing) <[email protected]>"
Fingerprint: 798a ec65 4e5c 1542 8c8e 42ee aa16 fcbc a621 e701
From : https://rpm.releases.hashicorp.com/gpg
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : vault-1.16.2-1.x86_64 1/1Generating Vault TLS key and self-signed certificate...
Generating a 4096 bit RSA private key
.......................................................................................................................................................++
............................................++
writing new private key to 'tls.key'
-----
Vault TLS key and self-signed certificate have been generated in '/opt/vault/tls'.
Verifying : vault-1.16.2-1.x86_64 1/1
Installed:
vault.x86_64 0:1.16.2-1
Complete!
[root@mcw02 ~]# vault server -dev -dev-root-token-id=“dev-only-token”
==> Vault server configuration:
Administrative Namespace:
Api Address: http://127.0.0.1:8200
Cgo: disabled
Cluster Address: https://127.0.0.1:8201
Environment Variables: HADOOP_HOME, HISTCONTROL, HISTIMEFORMAT, HISTSIZE, HOME, HOSTNAME, JAVA_HOME, LANG, LESSOPEN, LOGNAME, LS_COLORS, MAIL, PATH, PORMPT_COMMADN, PWD, SHELL, SHLVL, SSH_CLIENT, SSH_CONNECTION, SSH_TTY, TERM, USER, XDG_RUNTIME_DIR, XDG_SESSION_ID, _
Go Version: go1.21.9
Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", disable_request_limiter: "false", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
Log Level:
Mlock: supported: true, enabled: false
Recovery Mode: false
Storage: inmem
Version: Vault v1.16.2, built 2024-04-22T16:25:54Z
Version Sha: c6e4c2d4dc3b0d57791881b087c026e2f75a87cb
==> Vault server started! Log data will stream in below:
2024-05-21T08:40:29.857+0800 [INFO] proxy environment: http_proxy="" https_proxy="" no_proxy=""
2024-05-21T08:40:29.857+0800 [INFO] incrementing seal generation: generation=1
2024-05-21T08:40:29.857+0800 [WARN] no `api_addr` value specified in config or in VAULT_API_ADDR; falling back to detection if possible, but this value should be manually set
2024-05-21T08:40:29.857+0800 [INFO] core: Initializing version history cache for core
2024-05-21T08:40:29.857+0800 [INFO] events: Starting event system
2024-05-21T08:40:29.858+0800 [INFO] core: security barrier not initialized
2024-05-21T08:40:29.858+0800 [INFO] core: security barrier initialized: stored=1 shares=1 threshold=1
2024-05-21T08:40:29.858+0800 [INFO] core: post-unseal setup starting
2024-05-21T08:40:29.873+0800 [INFO] core: loaded wrapping token key
2024-05-21T08:40:29.873+0800 [INFO] core: successfully setup plugin runtime catalog
2024-05-21T08:40:29.873+0800 [INFO] core: successfully setup plugin catalog: plugin-directory=""
2024-05-21T08:40:29.873+0800 [INFO] core: no mounts; adding default mount table
2024-05-21T08:40:29.874+0800 [INFO] core: successfully mounted: type=cubbyhole version="v1.16.2+builtin.vault" path=cubbyhole/ namespace="ID: root. Path: "
2024-05-21T08:40:29.875+0800 [INFO] core: successfully mounted: type=system version="v1.16.2+builtin.vault" path=sys/ namespace="ID: root. Path: "
2024-05-21T08:40:29.875+0800 [INFO] core: successfully mounted: type=identity version="v1.16.2+builtin.vault" path=identity/ namespace="ID: root. Path: "
2024-05-21T08:40:29.878+0800 [INFO] core: successfully mounted: type=token version="v1.16.2+builtin.vault" path=token/ namespace="ID: root. Path: "
2024-05-21T08:40:29.878+0800 [INFO] rollback: Starting the rollback manager with 256 workers
2024-05-21T08:40:29.879+0800 [INFO] core: restoring leases
2024-05-21T08:40:29.880+0800 [INFO] expiration: lease restore complete
2024-05-21T08:40:29.880+0800 [INFO] rollback: starting rollback manager
2024-05-21T08:40:29.880+0800 [INFO] identity: entities restored
2024-05-21T08:40:29.880+0800 [INFO] identity: groups restored
2024-05-21T08:40:29.881+0800 [INFO] core: Recorded vault version: vault version=1.16.2 upgrade time="2024-05-21 00:40:29.881043663 +0000 UTC" build date=2024-04-22T16:25:54Z
2024-05-21T08:40:29.881+0800 [INFO] core: post-unseal setup complete
2024-05-21T08:40:29.881+0800 [INFO] core: root token generated
2024-05-21T08:40:29.881+0800 [INFO] core: pre-seal teardown starting
2024-05-21T08:40:29.881+0800 [INFO] rollback: stopping rollback manager
2024-05-21T08:40:29.881+0800 [INFO] core: pre-seal teardown complete
2024-05-21T08:40:29.882+0800 [INFO] core.cluster-listener.tcp: starting listener: listener_address=127.0.0.1:8201
2024-05-21T08:40:29.882+0800 [INFO] core.cluster-listener: serving cluster requests: cluster_listen_address=127.0.0.1:8201
2024-05-21T08:40:29.882+0800 [INFO] core: post-unseal setup starting
2024-05-21T08:40:29.882+0800 [INFO] core: loaded wrapping token key
2024-05-21T08:40:29.882+0800 [INFO] core: successfully setup plugin runtime catalog
2024-05-21T08:40:29.882+0800 [INFO] core: successfully setup plugin catalog: plugin-directory=""
2024-05-21T08:40:29.883+0800 [INFO] core: successfully mounted: type=system version="v1.16.2+builtin.vault" path=sys/ namespace="ID: root. Path: "
2024-05-21T08:40:29.883+0800 [INFO] core: successfully mounted: type=identity version="v1.16.2+builtin.vault" path=identity/ namespace="ID: root. Path: "
2024-05-21T08:40:29.883+0800 [INFO] core: successfully mounted: type=cubbyhole version="v1.16.2+builtin.vault" path=cubbyhole/ namespace="ID: root. Path: "
2024-05-21T08:40:29.884+0800 [INFO] core: successfully mounted: type=token version="v1.16.2+builtin.vault" path=token/ namespace="ID: root. Path: "
2024-05-21T08:40:29.884+0800 [INFO] rollback: Starting the rollback manager with 256 workers
2024-05-21T08:40:29.884+0800 [INFO] core: restoring leases
2024-05-21T08:40:29.884+0800 [INFO] identity: entities restored
2024-05-21T08:40:29.884+0800 [INFO] identity: groups restored
2024-05-21T08:40:29.884+0800 [INFO] core: post-unseal setup complete
2024-05-21T08:40:29.884+0800 [INFO] core: vault is unsealed
2024-05-21T08:40:29.886+0800 [INFO] expiration: revoked lease: lease_id=auth/token/root/h3514d1c95b4d2e0108dc129ebd305e12342b57fb544e4ccd978af76ebfdb3b5d
2024-05-21T08:40:29.930+0800 [INFO] expiration: lease restore complete
2024-05-21T08:40:29.930+0800 [INFO] rollback: starting rollback manager
2024-05-21T08:40:29.932+0800 [INFO] core: successful mount: namespace="" path=secret/ type=kv version="v0.17.0+builtin"
WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
and starts unsealed with a single unseal key. The root token is already
authenticated to the CLI, so you can immediately begin using Vault.
You may need to set the following environment variables:
$ export VAULT_ADDR='http://127.0.0.1:8200'
The unseal key and root token are displayed below in case you want to
seal/unseal the Vault or re-authenticate.
Unseal Key: +sPbWdhzUK3Xr+s4SiW4Jvy7T7iGkW1rNsdTtCnXo78=
Root Token: “dev-only-token”
Development mode should NOT be used in production installations!
夯住不动
七、总结和延伸
总结：
至此成功安装部署Vault
延展：
下一篇详细了解下如何应用安全工具Vault
原文链接：https://blog.csdn.net/zhengzaifeidelushang/article/details/131283430
标签：INFO,core,令牌,0800,00,详细,vault,Vault From： https://www.cnblogs.com/machangwei-8/p/18203229