How to Install Harshicorp Vault on Ubuntu 24.04

Modern applications rely on secrets, including API keys, database passwords, TLS certificates, and encryption keys. When hardcoded, stored in plain files, or distributed insecurely, these secrets pose serious security risks. HashiCorp Vault addresses this challenge by providing a secure, centralized solution for managing sensitive information. It delivers secret storage, dynamic credential generation, encryption as a service, and fine-grained access control.

This article shows how to set up a production-ready Vault server on Ubuntu 24.04. It covers installing Vault from HashiCorp's official repository, generating TLS certificates with Let's Encrypt, configuring Vault for secure operation, initializing it with unseal keys, and accessing the CLI and web UI.

Prerequisites

Before you begin, ensure you:

• Have access to an Ubuntu 24.04 server as a non-root sudo user.
• Configure a domain A record pointing to your server's IP address.

Install Vault from HashiCorp Repository

This section covers adding HashiCorp's official APT repository to your system and installing Vault. HashiCorp maintains its own repository which gives you access to the latest stable releases directly from the vendor.

1. Update your package list.

   console Copy

   $ sudo apt update
   

   Explain Code

2. Install the required packages.

   console Copy

   $ sudo apt install gnupg curl lsb-release -y
   

   Explain Code

3. Add HashiCorp's GPG key. This key verifies that packages actually come from HashiCorp.

   console Copy

   $ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
   

   Explain Code

4. Add the HashiCorp repository to your system sources.

   console Copy

   $ echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
   

   Explain Code

5. Update the package index.

   console Copy

   $ sudo apt update
   

   Explain Code

6. Install Vault.

   console Copy

   $ sudo apt install vault -y
   

   Explain Code

7. Verify the installation.

   console Copy

   $ vault --version
   

   Explain Code

   Output:

   Vault v1.20.4 (55bd8f18c6c84aa89fdede4850a622c57f03bd7e), built 2025-09-23T13:22:38Z

8. Enable shell autocompletion for vault.

   console Copy

   $ vault -autocomplete-install
   

   Explain Code

9. Reload your shell to apply the autocompletion.

   console Copy

   $ exec $SHELL
   

   Explain Code

Configure Firewall Access

In this section, open the necessary ports in the firewall for Vault to be accessible. The steps configure UFW to allow HTTPS access to Vault.

1. Allow HTTPS access on port 8200 where Vault web UI runs.

   console Copy

   $ sudo ufw allow 8200/tcp
   

   Explain Code

2. Open port 80 temporarily to allow Certbot to issue TLS certificates.

   console Copy

   $ sudo ufw allow 80/tcp
   

   Explain Code

3. Reload firewall.

   console Copy

   $ sudo ufw reload
   

   Explain Code

Generate TLS Certificates with Let's Encrypt

This section covers obtaining TLS certificates using Certbot. Install and use Certbot to get free certificates from Let's Encrypt.

1. Install Certbot.

   console Copy

   $ sudo apt install certbot -y
   

   Explain Code

2. Obtain a certificate for your domain. Replace vault.example.com with your actual domain and your-email@example.com with your email address.

   console Copy

   $ sudo certbot certonly --standalone -d vault.example.com --non-interactive --agree-tos --email your-email@example.com
   

   Explain Code

3. Remove the port 80 rule from your firewall after obtaining the TLS certificates.

   console Copy

   $ sudo ufw delete allow 80/tcp
   

   Explain Code

4. Reload the firewall.

   console Copy

   $ sudo ufw reload
   

   Explain Code

5. Create a directory for Vault certificates.

   console Copy

   $ sudo mkdir -p /opt/vault/tls
   

   Explain Code

6. Copy the Let's Encrypt certificates to Vault's directory. Replace vault.example.com with your domain name.

   console Copy

   $ sudo cp /etc/letsencrypt/live/vault.example.com/fullchain.pem /opt/vault/tls/cert.pem
   

   Explain Code

7. Copy the private key. Replace vault.example.com with your domain name.

   console Copy

   $ sudo cp /etc/letsencrypt/live/vault.example.com/privkey.pem /opt/vault/tls/key.pem
   

   Explain Code

8. Set proper ownership for the certificates.

   console Copy

   $ sudo chown -R vault:vault /opt/vault/tls
   

   Explain Code

9. Set restrictive permissions on the certificate files.

   console Copy

   $ sudo chmod 600 /opt/vault/tls/cert.pem /opt/vault/tls/key.pem
   

   Explain Code

10. Create an automatic certificate renewal script.

    console Copy

    $ sudo tee /etc/letsencrypt/renewal-hooks/deploy/vault.sh > /dev/null << 'EOF'
    #!/bin/bash
    cp /etc/letsencrypt/live/vault.example.com/fullchain.pem /opt/vault/tls/cert.pem
    cp /etc/letsencrypt/live/vault.example.com/privkey.pem /opt/vault/tls/key.pem
    chown -R vault:vault /opt/vault/tls
    chmod 600 /opt/vault/tls/*
    systemctl reload vault
    EOF
    

    Explain Code

11. Make the renewal script executable.

    console Copy

    $ sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/vault.sh
    

    Explain Code

Configure Vault for Production

This section covers configuring Vault for production use. The configuration file controls how Vault operates, including storage backend, network listeners, and security settings.

1. Back up the original configuration file.

   console Copy

   $ sudo cp /etc/vault.d/vault.hcl /etc/vault.d/vault.hcl.backup
   

   Explain Code

2. Create a production configuration. Replace vault.example.com with your actual domain.

   console Copy

   $ sudo tee /etc/vault.d/vault.hcl > /dev/null << 'EOF'
   # Vault production configuration
   
   # Enable the web UI
   ui = true
   
   # Disable memory locking (set to false if you have limited RAM)
   disable_mlock = true
   
   # Storage backend - uses local filesystem
   storage "file" {
     path = "/opt/vault/data"
   }
   
   # HTTPS listener
   listener "tcp" {
     address       = "0.0.0.0:8200"
     tls_cert_file = "/opt/vault/tls/cert.pem"
     tls_key_file  = "/opt/vault/tls/key.pem"
   
     # Enforce minimum TLS version
     tls_min_version = "tls12"
   
     # Use secure cipher suites
     tls_cipher_suites = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
   
     # Do NOT require client certificates
     tls_require_and_verify_client_cert = "false"
     tls_disable_client_certs           = "true"
   }
   
   # Advertise the correct address to other Vault nodes
   api_addr = "https://vault.example.com:8200"
   cluster_addr = "https://vault.example.com:8201"
   EOF
   

   Explain Code

3. Enable the Vault service to start at boot.

   console Copy

   $ sudo systemctl enable vault
   

   Explain Code

4. Restart the Vault service with the new configuration.

   console Copy

   $ sudo systemctl restart vault
   

   Explain Code

5. Check that Vault started successfully.

   console Copy

   $ sudo systemctl status vault
   

   Explain Code

   Output should show:

   ● vault.service - "HashiCorp Vault - A tool for managing secrets"
        Loaded: loaded (/usr/lib/systemd/system/vault.service; enabled; preset: enabled)
        Active: active (running) since Thu 2025-10-02 22:15:08 UTC; 3s ago
   ...

Set Up Vault Environment

This section shows how to configure environment variables that tell the CLI where to find your Vault server.

1. Set the Vault address environment variable. Replace vault.example.com with your domain.

   console Copy

   $ echo 'export VAULT_ADDR="https://vault.example.com:8200"' >> ~/.bashrc
   

   Explain Code

2. Reload your shell configuration.

   console Copy

   $ source ~/.bashrc
   

   Explain Code

3. Verify the variable is set correctly.

   console Copy

   $ echo $VAULT_ADDR
   

   Explain Code

   Output:

   https://vault.example.com:8200

4. Test connectivity to Vault.

   console Copy

   $ vault status
   

   Explain Code

   Output:

   Key                Value
   ---                -----
   Seal Type          shamir
   Initialized        false
   Sealed             true

Initialize and Unseal Vault

This section covers initializing Vault to generate encryption keys and unsealing it to make it operational. Vault starts in a sealed state where it knows where its data is stored but can't decrypt it.

Understanding the Unseal Process

When you initialize Vault, it creates:

• Master key: Encrypts all your secrets
• Unseal keys: Parts of the master key split using Shamir's Secret Sharing algorithm
• Root token: Your initial admin access

The default setup creates 5 keys with a threshold of 3. This means you need any 3 of the 5 keys to unseal Vault. This prevents any single person from having complete access.

1. Initialize Vault with the default configuration.

   console Copy

   $ vault operator init
   

   Explain Code

   Output:

   Unseal Key 1: nk+b+gZRPzUcTx5yDaY7Rxv26m/JqPuuhlYKVLxqvcLV
   Unseal Key 2: kXi4dk1pDpTj0efjPekMMEnqMFIGVbbIECyAbYXu4XIi
   Unseal Key 3: jPyTlTCeKAMHu16+EYHc6FcmqW+hQ8B9ZN02vQ8VnOmd
   Unseal Key 4: 5rvMMnEvcIQdcAtKd+UxQX7FqsDbMEtuHqRijFlyjR9l
   Unseal Key 5: igcpq67F04IhxzAFQ/i+VbC5+vPSRNY5Zsg/xHu+qgID
   
   Initial Root Token: hvs.4H1RRGrHO8cbu2QumVuXUfOV
   ...

   Note

   Save these keys in separate, secure locations, as you'll never see them again.

2. Start unsealing Vault with the first key. You need to run this command 3 times with 3 different keys.

   console Copy

   $ vault operator unseal
   

   Explain Code

   Paste the first key when prompted. Output shows progress:

   ...
   Unseal Progress    1/3
   ...

3. Continue with the second key.

   console Copy

   $ vault operator unseal
   

   Explain Code

   Output:

   ...
   Unseal Progress    2/3
   ...

4. Use the third key to complete unsealing.

   console Copy

   $ vault operator unseal
   

   Explain Code

   When successful, you'll see:

   ...
   Sealed          false
   ...

   Note

   If unsealing fails, make sure you're using 3 different keys and not the same ones.

5. Log in with the root token.

   console Copy

   $ vault login
   

   Explain Code

   Enter the Initial Root Token when prompted.

Access the Vault Web UI

This section shows how to access Vault's web interface, which provides a visual and intuitive way to manage secrets alongside the CLI.

1. Open your browser and navigate to your Vault URL:

   https://vault.example.com:8200

2. You'll see the Vault login screen. Select Token as the method.

   

3. Enter your root token and click Sign In.

4. The dashboard shows your Vault's status and available secrets engines.

   

Conclusion

You now have a production-ready Vault installation on Ubuntu 24.04 with proper TLS encryption and both CLI and web access. Your Vault server is ready to securely store and manage secrets for your infrastructure. Refer to the Vault Documentation for more information.