Catalog / Security & identity

OpenBao

Secrets management and encryption as a service, community fork of Vault

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.7.1↗ Azure Marketplace2.7.1↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.7.1$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-02Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.7.1$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseMPL-2.0
UpstreamOpenBao (Linux Foundation)
Machine-readableproduct.json · catalog.json
What is OpenBao

OpenBao is an open-source secrets management platform, forked from HashiCorp Vault 1.14 and now hosted by the Linux Foundation. Written in Go and distributed as a single static binary, OpenBao gives applications and operators a central place to store, generate, and rotate secrets: static key-value secrets, dynamic database credentials, AWS/GCP/Azure cloud credentials, x509 certificates via the PKI engine, encryption-as-a-service through the transit engine, SSH certificate authorities, JWT/OIDC issuance, and TOTP. Identity is unified through pluggable auth methods - userpass, AppRole, JWT/OIDC, Kubernetes, LDAP, GitHub, AWS IAM, Azure, GCP - and access is gated by ACL policies against fine-grained paths. The Web UI ships built in. State is held in a pluggable storage backend: file, integrated raft, or external (S3, DynamoDB, Postgres, MySQL). MPL-2.0 license, fully auditable, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • OpenBao listener bound to 127.0.0.1:8200 only - reachable from the network only through the Nginx reverse proxy on TCP 443 with TLS
  • Auto-initialisation at first boot with 5 unseal key shares and a threshold of 3; the initial root token plus all 5 unseal keys are written to /root/openbao-credentials.txt (chmod 600 root-only)
  • Auto-unseal on every reboot using a root-only cached subset of the unseal keys at /var/lib/openbao/.unseal-keys - operators do not have to SSH in and unseal manually after a reboot; a clear production-migration path is documented in the same credentials file (revoke root token, replace TLS cert, move to KMS or Transit auto-unseal, delete the on-disk cache)
  • Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy), long-poll timeouts tuned for OpenBao's blocking events endpoint
  • UFW firewall pre-configured - only TCP 22, 80, 443 are exposed; OpenBao on TCP 8200 stays loopback-only
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

ARCHITECTURE NOTES

Storage is the PebbleDB backend at /opt/openbao/data (OpenBao 2.7 removed the file backend), persisted across reboots. The seal type is shamir (default); we set the standard 5-key share / 3-key threshold. For production use the credentials file documents how to migrate to KMS (AWS/GCP/Azure) or Transit auto-unseal so the on-disk seal keys can be removed. OpenBao's own listener has tls_disable=true because Nginx terminates TLS - operators replace the self-signed certificate with a CA-signed one through `certbot --nginx` without restarting OpenBao (which would re-seal the store).

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/openbao-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-udwnfhgcn7g72/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer openbao --plan payg-gen2
az vm create -g my-rg -n openbao --size Standard_D2s_v3 \
  --image lynxroute:openbao:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

OpenBao 2.7.1

AWS · 2026-10-02Azure · 2026-10-02
  • OpenBao updated 2.6.2 -> 2.7.1. MPL-2.0 unchanged
  • Storage now uses the PebbleDB backend at /opt/openbao/data because OpenBao 2.7 removed the file backend; data from an existing 2.6 file-backend server must be converted with bao operator migrate before upgrading it
  • Security: 14 advisories fixed across 2.7.0 and 2.7.1, including cross-namespace policy cache traversal, AppRole Secret IDs usable after expiry, Kubernetes service-account tokens accepted after revocation, and non-validated names issued through ACME
  • New: post-quantum ML-DSA signatures in the PKI and Transit engines, post-quantum TLS key exchange on listeners, and KMS-backed external keys for PKI and Transit
  • The LDAP, Kerberos and RADIUS auth methods, the LDAP secrets engine and the cloud KMS auto-unseal seals now ship as separate OpenBao plugins; the KV secrets engine stays enabled at secret/
  • Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates