CLI command
skarbiec lockdown
Take every consumer's access away in one step when a machine, a laptop or a bearer may be compromised, so nothing reads the vault through a grant until it is issued again.
Invocation#
skarbiec lockdown [--except <consumer,...>] [--yes]Purpose#
Take every consumer's access away in one step when a machine, a laptop or a bearer may be compromised, so nothing reads the vault through a grant until it is issued again.
Required inputs and options#
- No positional input. --except names consumers whose grants stay, comma separated; each must hold a grant. --yes withdraws.
Output and state effects#
- Without --yes, prints ok, applied false, would_withdraw (every consumer holding a grant but those kept) and kept, and changes nothing. With --yes, withdraws each of those grants as grant revoke <consumer> does, journals lockdown with the consumers withdrawn and kept and the count that failed, and prints applied true, revoked, kept and failed (each grant that could not be withdrawn, with its error); ok is false when one failed, and the others are withdrawn regardless. Item values and recipients are untouched: rotating the secrets a stolen bearer could read is the next step. POST /v1/operator/lockdown takes except and yes the same way; Desktop's Settings → Policy shows it as Lock everything down.
Refusals#
- A positional argument exits 2 with the usage. --except naming a consumer that holds no grant is refused naming it before anything is withdrawn, so a misspelled consumer is never withdrawn by mistake.
Examples#
skarbiec lockdown skarbiec lockdown --except browser-host --yes skarbiec grant list --item <id> # who could read a secret, to rotate it next