Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The topic of personal password management has been covered in great detail time after time. This question is aimed at the business or organization that needs to keep track of many unique passwords for many clients. What are some strategies/tools or ideas you all have for accomplishing this task?

I was at an Interactive Agency, where we needed to keep track of client DB, ftp, mail... and for different environments for the app so any one client would have up to 3-10 passwords usually. This can get crazy when there are more than 250 clients

share

migration rejected from superuser.com Sep 3 '13 at 17:20

This question came from our site for computer enthusiasts and power users. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by Zoredache, Falcon Momot, mdpc, TheCleaner, gWaldo Sep 3 '13 at 17:20

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

4  
This should be marked "community wiki". –  joschi Jul 14 '10 at 5:35
comments disabled on deleted / locked posts

9 Answers 9

I have been on a quest to find, and convince our organization to use, an industrial strength, multi-user, password manager for a long time now. I see, I am not alone.

If you do not mind, I would like to post and maintain my quest notes here until my goal is reached.

Summary

Storing passwords and other sensitive information in solutions like password protected files, simple databases, intranet pages does not provide enough security, control or auditing, in a multi-user settings environment. A more adequate solution would meet the following requirements.

Requirements

  • Multi-User.
  • Multi-Computer.
  • Auditing.
  • Secure Notes.
  • Clear text exports.
  • A known and trusted encryption method.
  • Authentication information should only be stored as a hash.
  • Data should be encrypted on the wire.
  • Data should be stored on local network.
  • Should work for the entire organization, even if it requires multiple instances.
  • Reasonably priced.
  • Active Directory integration.
  • Password Sharing.

    Would-Be-Nice Features...

  • Multi-Factor Authentication.
  • Zero installation on client pc.
  • An API to do common tasks like backups.
  • Open Source.
  • Secure File Storage.
  • Web and/or GUI Single Signon capability.

    BONUS

  • Able to sell itself to a resistant organization.

Promising Options

Enterprise

Personal

More

share
    
although this post is mighty old - any updates on finding mr. right? –  mrnye Oct 20 '11 at 0:51
    
I am still maintaining this post as I find new possibilities. My favorite is LastPass, just waiting for local hosting of the data. The good news is, finding a password safe solution has made it on to the project list. The corporate cogs are slowly churning. –  Nathan Hartley Oct 20 '11 at 13:37
    
LastPass Enterprise now has local hosting, but it costs $25,000 (includes installation and 2 years of maintenance), plus the normal user fees. –  Nathan Hartley Dec 8 '11 at 19:39
1  
we are using passpack, it is alright but definitely needs some work to make group sharing cleaner. –  mrnye Dec 9 '11 at 0:42
1  
I would add in Passwordstate to the list, we have a demo implementation and it looks promising at a fraction of the cost. clickstudios.com.au –  Chris Magnuson Dec 21 '11 at 19:19
show 3 more comments

At my last company we used Intuit's Quickbase. Quickbase seems to be like a sort of online MS Access database where you can easily build tables and their relationships. It made it very easy to create a simple password database that was searchable, access controlled, and secured via SSL.

Intuit Quickbase - http://quickbase.intuit.com/

share
6  
Are you asking a question or shilling for rep? –  Josh K Mar 6 '10 at 15:43
1  
The question was actually meant for a place to post suggestions for doing so. and I was merely wanting to share what I've seen in the past, wasn't trying to "shil for rep". –  Brian Wigginton Mar 6 '10 at 20:24
    
Don't sweat it Brian. Sometimes folks can get a little edgy here. =) –  Wesley Mar 6 '10 at 22:27
1  
@Josh K - I don't think he is at all. Based on his question, he was looking for ways to do it, while sharing his experience. Definitely doesn't deserve the downvotes. If he was shilling for reps he would of marked his answer as correct ... –  Ryan Gibbons Mar 7 '10 at 23:03
3  
If he wanted to post suggestions he could have made it a community wiki instead of just answering. –  Josh K Mar 8 '10 at 16:53
show 1 more comment

Have a look at the following:

share
add comment

I believe that this can be done at least in part with a properly configured LDAP/active directory configuration.

share
    
Very Interesting Idea. I would like to see this thought expanding on more. Basically how to handle the odd-ball data stored with each password –  Ryan Gibbons Mar 7 '10 at 22:51
    
I am not exactly sure which odd-ball data you are thinking of. But ldap would be able to store attributes with sets of credentials. –  spowers Mar 9 '10 at 3:59
add comment

Where I work we have been using KeePass 2.x to store about 1000 passwords for the last three years. This works ok with one file accessed by about 4 people concurrently.

You can organise the passwords into folders (one per client per example), and the search functionality works very well.

There may be some limitations to their multi-user approach, and we may just have been lucky not to hit them (yet), but it seems ok for our scale, and it is an actively developed Open Source project with a good reputation for being secure against decoding.

What is nice about KeePass is it is designed with passwords in mind, so includes password generation features. It is highly configurable, and you can add your own custom columns to the database.

share
    
We also use Keepass, but we have one database per client, this is mainly because we have specific staff allocated to various clients, access to the keepass databases is provided on an as needed basis. It reduces the number of passwords we have to reset if staff ever leave. –  Bryan Nov 9 '12 at 22:58
    
If staff leave, they will be able to access old versions of the database using the old password, so don't assume that this reduces the number of passwords you might need to change. You still need a password policy that covers all password to be properly secure. –  dunxd Nov 12 '12 at 11:32
2  
I'm talking about resetting passwords within the databases, not the passwords to access the databases, so old copies of databases don't matter, hence why it reduces the number of passwords that need resetting. –  Bryan Nov 12 '12 at 12:34
    
That makes sense. Good idea. –  dunxd Nov 12 '12 at 16:42
add comment

At our company, we use a basic database app, with a table set up for each type of password. The problem is it doesn't scale with hundred and hundreds accounts. We have about 400 customers each has a dev ftp account, dev mysql, prod mysql, etc. Doesn't scale!

We are looking into creating our own solution that will map the data in a more useful way. To where passwords are grouped by customers and information is stored there. So we can see which domains that have passwords are associated with each client. And set it up to where we can add services that might have extra fields. i.e. Database passwords would need a DB Name and Server Location and (at least for MySQL) the login host.

Doing something like this would allow us to find all passwords associated to a client, and then, a domain, or even a server if designed out correctly.

I guess really, we are looking for a basic account management app that handles passwords at it's core, but also stores some other basic information about the environment.

Not a lot out of apps out there that handle password management outside of personal environments

share
add comment

At a previous company I worked for, every co-worker had a GPG-key and the list with passwords would be encrypted with the key. Every time a new password was added, the list was decrypted, password added and re-encrypted with all keys. We made some scripts that made adding, deleting, changing and viewing easier.

share
add comment

We normally setup an internal MySQL database with everything stored by client. Tables are created on a per client basis.

share
    
I'm considering doing this this. LAMP/WAMP stacks are definitely abundant, and it would be easy to whip one of these up. –  Brian Wigginton Mar 6 '10 at 20:25
    
It's even easier if you run it locally (OSX = MAMP), then everything is right there in front of you and you can expand as much as you want. –  Josh K Mar 8 '10 at 16:53
2  
It might be nicer on a NoSQL database like CouchDB. That way you don't need to worry about having the right fields for each client, or setting up custom tables or being able to search across different tables. –  kaerast Apr 21 '10 at 21:48
add comment

I've been looking into putting SFLvault in place at work.

Description from the project's wiki:

SFLvault is a Networked credentials store and authentication manager.

It has a client/vault (server) architecture allowing to cryptographically store and organise loads of passwords for different machines and services.

Two of it's features I'm looking into are a permission management system (different accounts have different access to passwords) and automatic connections to services (ssh, mysql, sudo...).

share
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.