Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given how important it is to have different passwords for different systems, how does a data centre with thousands of servers manage? I'm only managing a few dozen machines at the moment, but the number tends to grow, especially virtual machines. If you clone a VM, it will have the same password, and if that's part of an automated workflow, there isn't much chance to change it. If you automate changing the passwords, that needs to be done securely, and you're back to a single point of failure. So, what do people do?

I should explain that the problem isn't thinking of passwords (there are plenty of password generators for that) but having an efficient process for setting and recording them, especially when the machines are created automatically.

share|improve this question
    
There is a similar question pertaining to corporate password safes here. serverfault.com/questions/119892 –  Nathan Hartley Aug 4 '10 at 20:43
add comment

6 Answers

up vote 2 down vote accepted

Most places uses two sets of passwords: On-line authentication and off-line passwords. On-line authentication is typically done with an authentication/authorization (AA) system like Kerberos. Each administrator user is assigned the proper tokens and access rights on the servers

For off-line administration of critical systems the root passwords are stored separately (in our case in a physically disconnected system). All access to the password list is logged, and the user needs to enter a motivation for retrieving the root password of a server. Previously the off-line password list was a printed list stored in a safe.

When provisioning a VM you can typically settle for not having any root password, and just assign on-line authentication/authorization. It's very unlikely that you need to administrate VM machines when your AA servers are off-line.

share|improve this answer
add comment

Even tough you use LDAP, most system have a root/superadmin account for offline authentication, in case of every LDAP instance is down. Things that shouldn´t happen, will sooner than later happen.

LDAP could be your answer in this case, but for the offline root admin password you should use a central CMDB, a new random password for each server, and some sort of automate routines for regularly changing these passwords, and of course verify the changes which have been done.

If you clone a VM (which I don´t think you should do but that is another matter), certain routines must be performed, and one of those should be resetting all passwords.

Edit: To answer your headline "How do you choose passwords for a large number of servers?" - You don't. I would use random for all servers. The real question is how and when you will discover when someone have breached on of your servers.

share|improve this answer
    
+1 Kerberos also a good login mechanism. –  Chris S Feb 27 '10 at 16:21
add comment

I'd advise against sharing passwords between machines. If one gets cracked, potentially all your machines are compromised. However if you like the idea of re-installing them all... :)

I wouldn't use passwords that you can work out, e.g. part of the hostname, ip/mac address etc. Personally, I'd use some software designed to store passwords in a secure manner, such as Keepass. Allow keepass to generate the passwords for you. I use at least 12 chars, and include numbers, uppercase & lowercase, but I do use the 'avoid similar looking characters' option, for times when you have to manually type the password.

share|improve this answer
    
+1 for KeePass; we had 280-odd passwords at the last count, and this helps us keep track. –  RainyRat Feb 27 '10 at 12:54
    
+1 for KeePass also, using it on Windows and Mac here –  Andy Shellam Feb 27 '10 at 14:09
    
+1 for KeePass; Used it to keep track of everything internal and external. Let you track random passwords easily. Just manage access to it carefully. And it doesn't mean you don't have to change all those passwords when you have turnover. –  ongle Feb 27 '10 at 20:07
add comment

With that many systems two factor authentication via LDAP would work well. With one factor being an RSA secureid. If a cracker were to discover a user password they would still need at least three RSA number generations in a row before being able to duplicate future generations. Strong password policies to boot.

share|improve this answer
add comment

We have an application running as a local service that selects a random password every few weeks and changes it. We use a web portal that connects to the database where the hashed password are stored, for when we need to use a local admin account.

share|improve this answer
add comment

If you are using debian, you can

apt-get install pwgen

Then, run

pwgen -s 10

You'll get a list of passwords like this:

f8v80OYXeI 5MjxYpIIv2 Tm21s5L2Cn OIcli0rFzO baOxEpe76k Lkk4RrnbU0 JxmBJ2INUf
Opz0suRZ3w CItzZfEm2L e2C02fwjYI NG9szPlwiR fhr5IyY1VO 1C8GvLztE5 lYaKJFQ5vh
aAjQLPShN4 w3mMCM5ZGD 58qPYdXpQv 5Ai9vo98Tu O8MEczVUvm ZMnFNJM7Yw xA92RM2SIU
aGKHaR0Ow2 XCKdv966YN pEy1xnll4r 281ffAgBE4 dTCbw5eS0D dUWPqrW7GP yXTuubWHJ1
0nOFEatyuD nSefCV8yRG J7bgHIrEZ3 wDQWtG7QLz AOGGQx1agh zEDUp3Bt4I BS3m3EYf9q
...

These are randomly selected 10 character passwords that will be difficult to brute force. (The '-s' makes them random, pwgen's default is to make them pronounceable)

share|improve this answer
add comment

protected by MadHatter Apr 16 '13 at 10:20

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.