Looking for a solution to the problem to identify the vault root tokens, I found the following documentation
https://www.greenreedtech.com/identifying-active-hashicorp-vault-root-tokens/
The script related in this link worked in a vault instance that I have in version 1.5.4, but i have a problem listing the vault tokens in version 1.6.1
Traceback (most recent call last):
File "/home/vault/tokenlist-prod.py", line 31, in <module>
output = client.lookup_token(key, accessor=True)
File "/usr/local/lib/python3.10/dist-packages/hvac/v1/__init__.py", line 444, in lookup_token
return self._adapter.post(path, json=accessor_param, wrap_ttl=wrap_ttl)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 126, in post
return self.request("post", url, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 364, in request
response = super(JSONAdapter, self).request(*args, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 330, in request
utils.raise_for_error(
File "/usr/local/lib/python3.10/dist-packages/hvac/utils.py", line 41, in raise_for_error
raise exceptions.Forbidden(message, errors=errors, method=method, url=url)
hvac.exceptions.Forbidden: 1 error occurred:
* permission denied
, on post https://mydomain/v1/auth/token/lookup-accessor
python3 tokenlist-alter.py
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 174, in _new_conn
conn = connection.create_connection(
File "/usr/lib/python3/dist-packages/urllib3/util/connection.py", line 96, in create_connection
raise err
File "/usr/lib/python3/dist-packages/urllib3/util/connection.py", line 86, in create_connection
sock.connect(sa)
ConnectionRefusedError: [Errno 111] Connection refused
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 704, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 399, in _make_request
conn.request(method, url, **httplib_request_kw)
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 239, in request
super(HTTPConnection, self).request(method, url, body=body, headers=headers)
File "/usr/lib/python3.10/http/client.py", line 1282, in request
self._send_request(method, url, body, headers, encode_chunked)
File "/usr/lib/python3.10/http/client.py", line 1328, in _send_request
self.endheaders(body, encode_chunked=encode_chunked)
File "/usr/lib/python3.10/http/client.py", line 1277, in endheaders
self._send_output(message_body, encode_chunked=encode_chunked)
File "/usr/lib/python3.10/http/client.py", line 1037, in _send_output
self.send(msg)
File "/usr/lib/python3.10/http/client.py", line 975, in send
self.connect()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 205, in connect
conn = self._new_conn()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 186, in _new_conn
raise NewConnectionError(
urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f398c14cd60>: Failed to establish a new connection: [Errno 111] Connection refused
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 440, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 786, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 592, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='localhost', port=54453): Max retries exceeded with url: /v1/auth/token/accessors?list=True (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f398c14cd60>: Failed to establish a new connection: [Errno 111] Connection refused'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/vault/tokenlist-alter.py", line 25, in <module>
payload = client.list('auth/token/accessors')
File "/usr/local/lib/python3.10/dist-packages/hvac/v1/__init__.py", line 253, in list
return self._adapter.get("/v1/{0}".format(path), params=payload)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 113, in get
return self.request("get", url, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 364, in request
response = super(JSONAdapter, self).request(*args, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 313, in request
response = self.session.request(
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 529, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 645, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 519, in send
raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPConnectionPool(host='localhost', port=54453): Max retries exceeded with url: /v1/auth/token/accessors?list=True (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f398c14cd60>: Failed to establish a new connection: [Errno 111] Connection refused'))
The token I use to run the script is a root token
the urls i use have ssl certificate
Could someone help me with this problem?
Share my Script Script Py
Share Script
#!/usr/local/bin/python3
import os
import time
import hvac
import urllib3
from prettytable import PrettyTable
urllib3.disable_warnings()
try:
os.environ["VAULT_ADDR"] = "https://vault.test.com"
except Exception:
print("The VAULT_ADDR environment must be set.")
os._exit(1)
try:
os.environ["VAULT_TOKEN"] = "lalala"
except Exception:
print("The VAULT_TOKEN environment must be set.")
os._exit(1)
client = hvac.Client(url=os.environ['VAULT_ADDR'], verify=False, token=os.environ["VAULT_TOKEN"])
payload = client.list('auth/token/accessors')
keys = payload['data']['keys']
x = PrettyTable()
x.field_names = ["Display Name", "Creation Time", "Expiration Time", "Policies", "Token Accessor"]
for key in keys:
output = client.lookup_token(key, accessor=True)
display_name = output['data']['display_name']
creation_date = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(output['data']['creation_time']))
expire_time = output['data']['expire_time']
policies = output['data']['policies']
accessor = key
if "root" in policies:
x.add_row([display_name, creation_date, expire_time, policies, accessor])
print(x)