Rotate a local Linux password, store the new password in HashiCorp Vault

rotate.sh

#!/bin/sh
# Script for rotating passwords on the local machine.
# Make sure and store VAULT_TOKEN as an environment variable before running this.

USERNAME=$1
PASSLENGTH=$2
VAULTURL=$3
NEWPASS=$(openssl rand -base64 $PASSLENGTH)
JSON="{ \"data\": { \"root\": \"$NEWPASS\" } }"

# First commit the new password to vault
curl -H "X-Vault-Token: $VAULT_TOKEN" -X POST --data "$JSON" $VAULTURL/v1/secret/data/linux/$(hostname)_rootpw

# Then set it on the local machine
echo $NEWPASS | passwd root --stdin