{
 "slug": "openbao",
 "name": "OpenBao",
 "tagline": "Secrets management and encryption as a service, community fork of Vault",
 "category": "security-identity",
 "use_cases": [
  "secrets-management",
  "pki",
  "vault-alternative"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "OpenBao (Linux Foundation)",
  "url": "https://openbao.org",
  "license": "MPL-2.0",
  "license_url": "https://github.com/openbao/openbao/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.7.1",
   "last_build": "2026-10-02",
   "entity_id": "prod-udwnfhgcn7g72",
   "ami_alias": "/aws/service/marketplace/prod-udwnfhgcn7g72/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-n5hwag2e7u45s",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.7.1",
   "last_build": "2026-10-02",
   "offer_id": "openbao",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:openbao:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.openbao?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/openbao/",
  "json": "https://lynxroute.com/products/openbao/product.json"
 },
 "release_notes": [
  {
   "version": "2.7.1",
   "title": "OpenBao 2.7.1",
   "notes": "* OpenBao updated 2.6.2 -> 2.7.1. MPL-2.0 unchanged\n* Storage now uses the PebbleDB backend at /opt/openbao/data because OpenBao 2.7 removed the file backend; data from an existing 2.6 file-backend server must be converted with bao operator migrate before upgrading it\n* Security: 14 advisories fixed across 2.7.0 and 2.7.1, including cross-namespace policy cache traversal, AppRole Secret IDs usable after expiry, Kubernetes service-account tokens accepted after revocation, and non-validated names issued through ACME\n* New: post-quantum ML-DSA signatures in the PKI and Transit engines, post-quantum TLS key exchange on listeners, and KMS-backed external keys for PKI and Transit\n* The LDAP, Kerberos and RADIUS auth methods, the LDAP secrets engine and the cloud KMS auto-unseal seals now ship as separate OpenBao plugins; the KV secrets engine stays enabled at secret/\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "2.6.2",
   "title": "OpenBao v2.6.2-kv2",
   "notes": "* Same upstream version; the previous release already shipped as \"v2.6.2-kv\", so this one takes the -kv2 marker. Log rotation no longer silently stops OpenBao logging: the unit writes via StandardOutput=append:, so systemd owns the fd and the previous `create` rotation left the service writing into the old renamed file while the live log stayed empty. Now uses copytruncate.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "2.6.2",
   "title": "OpenBao v2.6.2-kv",
   "notes": "* OpenBao upgraded to 2.6.2 (from 2.6.1) - MPL-2.0 secrets manager\n* Security: internal operation types can no longer be dispatched from inline authentication and workflows, which had allowed token creation (GHSA-rh46-vc3j-w2w3)\n* Security: allowed_ip_sans_cidr is now enforced on IP SANs taken from a CSR in the PKI secrets engine (GHSA-g892-p242-8g86)\n* Fixes OIDC default keys being written outside per-namespace storage, and propagates sys/raw, sys/leases and wrapped requests to the active node\n* The kv-v2 secrets engine is mounted at secret/ on first boot - the CLI\n  quickstart (bao kv put secret/hello message=world) works out of the box\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "2.6.1",
   "title": "OpenBao v2.6.1-kv",
   "notes": "* OpenBao upgraded to 2.6.1 (from 2.6.0) - MPL-2.0 secrets manager\n* The kv-v2 secrets engine is mounted at secret/ on first boot - the CLI\n  quickstart (bao kv put secret/hello message=world) works out of the box\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "2.6.0",
   "title": "OpenBao v2.6.0-kv",
   "notes": "* Upgraded OpenBao to 2.6.0 (from 2.5.5) - MPL-2.0 identity-based secrets\n  manager\n* The kv-v2 secrets engine is mounted at secret/ on first boot - the CLI\n  quickstart (bao kv put secret/hello message=world) works out of the box\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-20"
   }
  },
  {
   "version": "2.5.5-kv",
   "title": "OpenBao v2.5.5-kv",
   "notes": "* The kv-v2 secrets engine is now mounted at secret/ on first boot - the CLI\n  quickstart (bao kv put secret/hello message=world) works out of the box\n* Re-release of OpenBao 2.5.5 - upstream version unchanged\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-09"
   }
  },
  {
   "version": "2.5.5-kv",
   "title": "OpenBao 2.5.5",
   "notes": "* Updated OpenBao to 2.5.5\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before release; SBOM (CycloneDX 1.6) and CIS Conformance Report included\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-09"
   }
  },
  {
   "version": "2.5.4",
   "title": "OpenBao 2.5.4 - May 2026",
   "notes": "* OpenBao 2.5.4 on Ubuntu 24.04 LTS\n* Security release - 3 CVE fixes: CVE-2026-46358 (audit logs dropping\n  custom headers in inline auth), CVE-2026-46405 (hidden default\n  token issuance from auth plugin endpoints), CVE-2026-45808 (removed\n  legacy lease endpoints sys/revoke, sys/renew, sys/revoke-prefix,\n  sys/revoke-force due to cross-namespace lease modification)\n* Bug fixes - login MFA invalidation for standby nodes, list_scan\n  response keys filter on empty list responses, default rate limit\n  exempt paths on quota config invalidation, postgresql constraint\n  names for shared partition deployments\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-05-23",
    "azure": "2026-06-07"
   }
  },
  {
   "version": "2.5.3",
   "title": "OpenBao 2.5.3 - Initial release (May 2026)",
   "notes": "* OpenBao 2.5.3 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Auto-initialisation + auto-unseal at first boot, 5-of-3 Shamir key share\n* Initial root token + all 5 unseal keys at /root/openbao-credentials.txt (chmod 600)\n* OpenBao listener bound to 127.0.0.1:8200, Nginx reverse proxy with TLS on 443\n* Auto-unseal on reboot from /var/lib/openbao/.unseal-keys (chmod 600)\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-05-14"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.7.1",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "2.6.2",
   "aws": "2026-08-31",
   "azure": "2026-08-31"
  },
  {
   "version": "2.6.1",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "2.6.0",
   "aws": "2026-07-20",
   "azure": "2026-07-20"
  },
  {
   "version": "2.5.5-kv",
   "aws": "2026-07-09"
  },
  {
   "version": "2.5.5",
   "aws": "2026-06-19",
   "azure": "2026-06-20"
  },
  {
   "version": "2.5.4",
   "aws": "2026-05-23",
   "azure": "2026-06-07"
  },
  {
   "version": "2.5.3",
   "aws": "2026-05-14"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-udwnfhgcn7g72/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer openbao --plan payg-gen2\naz vm create -g my-rg -n openbao --size Standard_D2s_v3 \\\n  --image lynxroute:openbao:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "OpenBao is an open-source secrets management platform, forked from HashiCorp Vault 1.14 and now hosted by the Linux Foundation. Written in Go and distributed as a single static binary, OpenBao gives applications and operators a central place to store, generate, and rotate secrets: static key-value secrets, dynamic database credentials, AWS/GCP/Azure cloud credentials, x509 certificates via the PKI engine, encryption-as-a-service through the transit engine, SSH certificate authorities, JWT/OIDC issuance, and TOTP. Identity is unified through pluggable auth methods - userpass, AppRole, JWT/OIDC, Kubernetes, LDAP, GitHub, AWS IAM, Azure, GCP - and access is gated by ACL policies against fine-grained paths. The Web UI ships built in. State is held in a pluggable storage backend: file, integrated raft, or external (S3, DynamoDB, Postgres, MySQL). MPL-2.0 license, fully auditable, no vendor lock-in.",
  "image_adds": "Security hardening:\n* OpenBao listener bound to 127.0.0.1:8200 only - reachable from the network only through the Nginx reverse proxy on TCP 443 with TLS\n* Auto-initialisation at first boot with 5 unseal key shares and a threshold of 3; the initial root token plus all 5 unseal keys are written to /root/openbao-credentials.txt (chmod 600 root-only)\n* Auto-unseal on every reboot using a root-only cached subset of the unseal keys at /var/lib/openbao/.unseal-keys - operators do not have to SSH in and unseal manually after a reboot; a clear production-migration path is documented in the same credentials file (revoke root token, replace TLS cert, move to KMS or Transit auto-unseal, delete the on-disk cache)\n* Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy), long-poll timeouts tuned for OpenBao's blocking events endpoint\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed; OpenBao on TCP 8200 stays loopback-only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nARCHITECTURE NOTES\n\nStorage is the PebbleDB backend at /opt/openbao/data (OpenBao 2.7 removed the file backend), persisted across reboots. The seal type is shamir (default); we set the standard 5-key share / 3-key threshold. For production use the credentials file documents how to migrate to KMS (AWS/GCP/Azure) or Transit auto-unseal so the on-disk seal keys can be removed. OpenBao's own listener has tls_disable=true because Nginx terminates TLS - operators replace the self-signed certificate with a CA-signed one through `certbot --nginx` without restarting OpenBao (which would re-seal the store)."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}