---
title: "Install Hashi Corp Vault on Ubuntu"
slug: "install-hashi-corp-vault-on-ubuntu"
updated: 2025-04-30T10:03:33Z
published: 2025-04-30T10:03:33Z
canonical: "help.symphonysummitai.com/install-hashi-corp-vault-on-ubuntu"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.symphonysummitai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Hashi Corp Vault on Ubuntu

HashiCorp Vault is a robust tool designed to securely manage secrets and protect sensitive data in a dynamic environment. It offers a comprehensive set of features for managing access to tokens, passwords, certificates, and encryption keys, enabling organizations to enhance their security posture. Installing HashiCorp Vault on an Ubuntu system involves downloading the Vault binary, setting appropriate permissions, and configuring it to suit your security requirements. This guide will take you through the installation process, ensuring that Vault is properly set up and ready to store and manage your critical data assets securely. Following these steps, you can leverage Vault's capabilities to enhance your application's security infrastructure.

## Install Hashi Corp Vault on Ubuntu

To install Hashi Corp Vault on Ubuntu, perform the following steps:

1. Log in to the Ubuntu server as a root user.
2. Update your local package index to ensure you have the latest version of available packages. **sudo apt update**
3. Install Python3 on the Ubuntu machine. **sudo apt install -y python3**
4. To check the installed version of Python, use the command. **python3 –version**
5. Install pip package manager that is useful for managing Python libraries. **sudo apt install -y python3-pip**
6. Install the latest version of HashiCorp Vault. **wget** [**https://releases.hashicorp.com/vault/1.15.3/vault_1.15.3_linux_amd64.zip**](https://releases.hashicorp.com/vault/1.15.3/vault_1.15.3_linux_amd64.zip)
7. Unzip the HashiCorp Vault. Change the version details as per the installed version. **unzip vault_1.15.3_linux_amd64.zip**
8. Move the HashiCorp Vault to a system path. **sudo mv vault /usr/local/bin/**
9. Verify the version of the installed HashiCorp Vault. **vault --version**
10. Create the HashiCorp Vault user. **sudo useradd --system --home-dir /etc/vault.d --shell /bin/false vault**

**sudo mkdir -p /etc/vault.d**

**sudo chown vault:vault /etc/vault.d**
11. Create the HashiCorp Vault directories. **sudo mkdir -p /etc/vault.d /var/lib/vault**

**sudo chown -R vault:vault /etc/vault.d /var/lib/vault**
12. As the backend storage, configure HashiCorp Vault with MSSQL. **touch /etc/vault.d/vault.hcl** **vi /etc/vault.d/vault.hcl** Paste the following code exactly as it is.

```sql
storage "mssql" {
server = "192.168.X.X"
port = 1433
username = "vault"
password = "**********" 
database = "vault"
table = "Vault"
appname = "vault"
schema = "dbo"
connectionTimeout = 30
logLevel = 0
}

listener "tcp" {
address = "0.0.0.0:8200"
tls_disable = 1
}

 api_addr = "http://0.0.0.0:8200"
 ui = true
 disable_mlock = true
```

> [!NOTE]
> Notes
> 
> 1. In the code above, replace **“Server”** IP address with the IP address of your database.
> 2. Username and Password is the SSMS username and password created to authenticate the database.
> 3. Table vault is automatically created. Create a database named "vault" and a user named "vault," and assign a password to this user.
13. Setup the Systemd service for HashiCorp Vault. **Touch /etc/systemd/system/vault.service**

**Vi /etc/systemd/system/vault.service** Paste the following code exactly as it is.

```sql
[Unit]
Description=HashiCorp Vault
Documentation=https://www.vaultproject.io/docs/
After=network-online.target
Wants=network-online.target
[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
SecureBits=keep-caps
NoNewPrivileges=yes
ExecStart=/usr/local/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
StartLimitInterval=60
StartLimitBurst=3
LimitNOFILE=65536
LimitMEMLOCK=infinity
[Install]
 WantedBy=multi-user.target
```
14. Reload, enable and start the HashiCorp Vault. **sudo systemctl daemon-reload**

**sudo systemctl enable vault**

**sudo systemctl start vault**
15. Verify if the HashiCorp Vault is running. **sudo systemctl status vault**

### Initialize and Unseal Vault

1. Open a browser and navigate to http://localhost or server ip address[:8200](http://192.168.50.137:8200). The vault will be initialized now.
2. On the following screen, enter 5 in the Key shares and 3 in the Key threshold fields and click **Initialize**.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1719477841862.png)Figure: Root keys
3. On the unseal keys page, scroll to the bottom and select **Download Key**. Save the generated unseal keys file to your vault folder.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1719478334715.png)Figure: Unseal keys The unseal process requires these keys and the access requires the root token.
4. Click **Continue to Unseal**.
5. Open the download file.
6. Copy any one of the keys (not keys_base64) and enter it in the **Unseal Key Portion** field. Click **Unseal** to proceed.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1719478725994.png)Figure: Unseal vault The Unseal status shows 1/3 keys provided.
7. Enter another key and click **Unseal**. The Unseal status shows 2/3 keys provided.
8. Enter another key and click Unseal. After 3 out of 5 unseal keys are entered, the Vault is unsealed and is ready to operate.
9. Copy the root_token and enter the value in the Token field. Click **Sign In.**

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1719481258128.png)Figure: Sign in to vault
10. The Dashboard displays basic information about the current server settings.

![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1719482032037.png)Figure: Vault dashboard

### Auto Unseal

1. Save the Unsealed downloaded keys to the following folder. **cd /etc/vault.d/** **touch unseal_keys.json** - Add the entire JSON Key with the below command. **vi unseal_key.json**
2. The Python script to Auto Unseal the HashiCorp Vault. **touch /etc/vault.d/auto_unseal.py** **vi auto_unseal.py** Paste the following code exactly as it is.

```python
import requests
import json
import time

# Vault server address
VAULT_ADDRESS = "http://localhost or server ip address:8200"

# Path to unseal keys 
UNSEAL_KEYS_FILE = "/etc/vault.d/unseal_keys.json"

# Function to load unseal keys from a file
def load_unseal_keys():
 with open(UNSEAL_KEYS_FILE, 'r') as file:
 data = json.load(file)
 return data["keys"]

# Function to unseal Vault
def unseal_vault():
 keys = load_unseal_keys()
 for key in keys:
 response = requests.put(f"{VAULT_ADDRESS}/v1/sys/unseal", json={"key": key})
 if response.status_code == 200:
 print("Unseal step successful")
 else:
 print("Error in unsealing step:", response.json())
 return
 # Check if Vault is already unsealed
 if requests.get(f"{VAULT_ADDRESS}/v1/sys/seal-status").json()["sealed"] == False:
 print("Vault is unsealed.")
 return
print("All keys applied, Vault should be unsealed now.")

# Function to check if Vault is sealed
def is_vault_sealed():
 response = requests.get(f"{VAULT_ADDRESS}/v1/sys/seal-status")
 return response.json()["sealed"]

# Main function to auto-unseal Vault
def main():
 # Wait until Vault is accessible
 while True:
 try:
 if not is_vault_sealed():
 print("Vault is already unsealed.")
 return
 print("Vault is sealed, starting unseal process...")
 unseal_vault()
 break
 except requests.exceptions.ConnectionError:
 print("Vault is not reachable, retrying in 5 seconds...")
 time.sleep(5)

if __name__ == "__main__":
 main()
```
3. Configure a Systemd service to run the script. **touch /etc/systemd/system/vault-auto-unseal.service**

**vi /etc/systemd/system/vault-auto-unseal.service** Paste the following code exactly as it is.

```python
[Unit]
Description=Auto-Unseal Vault
After=vault.service
Requires=vault.service
[Service]
Type=simple
ExecStart=/usr/bin/python3 /etc/vault.d/auto_unseal.py
Restart=on-failure
[Install]
WantedBy=multi-user.target
```
4. Grant the required permission and validate python script.

**chmod +x /Enter the file path of the python script/auto_unseal.py** - For permission.

To check access in the script.

**python3 /Enter the file path of the python script/auto_unseal.py**
5. Enable and Start the Service for HashiCorp Vault.

**sudo systemctl daemon-reload**

**sudo systemctl start vault-auto-unseal.service**

**sudo systemctl status vault-auto-unseal.service**
6. To test the setup run the following commands.

s**udo systemctl status vault**

**sudo systemctl status vault-auto-unseal.service**