Introduction

HashiCorp Vault is a great tool to keep you secrets the right way. It’s used a lot in the industry and rightfully so.
Want to install Vault on Linux the right way? This short guide shows you how to set up HashiCorp Vault 2.1.1 in production mode on an Linux VM.

What You Need

Before you start, make sure you have:

  • A Linux VM (I used Ubuntu)
  • A user with sudo access
  • Port 8200 open on your firewall

Procedure to Install HashiCorp Vault

Follow these six steps in order. You’ll go from a fresh Linux VM to a running to a Vault server ready for production use.

Step 1: Add the HashiCorp Vault Repository

First, install the tools you need and add the official HashiCorp repository:

$ sudo apt update && sudo apt install -y gpg wget

$ wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

$ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

Step 2: Install the HashiCorp Vault package

Now install Vault with one command on a specific version:

$ sudo apt update && sudo apt install -y vault=2.1.1-1
$ sudo apt-mark hold vault

Check that it works:

$ vault --version
Vault v2.1.1

The install also creates a vault system user and a systemd service for you.

Step 3: Create the Production Config

Dev mode stores everything in memory. That is not safe. For production, Vault needs a config file and real storage.

Open the config file:

$ sudo vim /etc/vault.d/vault.hcl

Replace the content with this:

ui = true

storage "raft" {
  path    = "/opt/vault/data"
  node_id = "vault-node-1"
}

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
}

api_addr     = "https://YOUR_SERVER_IP:8200"
cluster_addr = "https://YOUR_SERVER_IP:8201"

Replace YOUR_SERVER_IP with your VM’s IP address or domain name.

Important: Production Vault must use TLS. The install creates self-signed certificates in /opt/vault/tls/. They work for testing, but for real production you should replace them with certificates from your own CA or Let’s Encrypt.

Step 4: Start and Enable HashiCorp Vault

Start the service and make it run at boot:

$ sudo systemctl enable vault
$ sudo systemctl start vault
$ sudo systemctl status vault

You should see active (running) in green.

Step 5: Initialize HashiCorp Vault

Tell your terminal where Vault lives:

$ export VAULT_ADDR='https://127.0.0.1:8200'
$ export VAULT_SKIP_VERIFY=true

(Only use VAULT_SKIP_VERIFY if you still run the self-signed certificate.)

Now initialize:

$ vault operator init
Unseal Key 1: eFWUT4vhTIx6oQqUu/rA83o+aiMp/Pq5QrqMHwjHXeOK
Unseal Key 2: 6HSSoq4Pi/shMmilWs4uzlDYAsiM/pWW+MIdYoWkNeXe
Unseal Key 3: UmMLkF9RgTM3iyfQIvftgNohKnll99wzE4yhLJMCbPLa
Unseal Key 4: yyxU25SN0wFUVTK3nt1WKEWN0PJMjvCogimfbKYCruD8
Unseal Key 5: L7xJZe9UDKScJvHa5DxTaqEISLnO7q4+8L+C0T+B3U5c

Initial Root Token: hvs.Ohgf65vVQe0FNCkztR7aPf8D

Vault prints 5 unseal keys and 1 root token. Save them somewhere safe. If you lose them, you lose access to your secrets. Forever.

Step 6: Unseal HashiCorp Vault

Vault starts in a sealed state. Seal is a security state that keeps data encrypted without read or write permissions to protect your data. Unseal it with 3 of your 5 keys:

$ vault operator unseal   # paste key 1
$ vault operator unseal   # paste key 2
$ vault operator unseal   # paste key 3

Then log in with your root token:

$ vault login
Token (will be hidden): 
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

That’s it. Vault is now running in production mode.

Quick Test

Store and read your first secret:

$ vault secrets enable -path=secret kv-v2
Success! Enabled the kv-v2 secrets engine at: secret/
$ vault kv put secret/test password="hello123"
== Secret Path ==
secret/data/test

======= Metadata =======
Key                Value
---                -----
created_time       2026-10-01T10:57:55.85967221Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1
$ vault kv get secret/test
== Secret Path ==
secret/data/test

======= Metadata =======
Key                Value
---                -----
created_time       2026-10-01T10:57:55.85967221Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

====== Data ======
Key         Value
---         -----
password    hello123

Final Tips

Summary

You just learned how to install Vault 2.1.1 on Linux in production mode. You added the official HashiCorp repository, installed a pinned version of Vault, and held it so it won’t upgrade without you knowing. Then you wrote a real production config with Raft storage and TLS, started Vault as a systemd service, and initialized and unsealed your server.

Your secrets now have a safe home. Before you go live, replace the self-signed certificate, store your unseal keys and root token somewhere secure, and set up regular backups of your data. From here, the next step is to create policies and tokens for your apps and users, so you never need the root token for daily work.

Tags: