Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Obviously seeing as how many of us here are system administrator type people, we have a lot of passwords strung out across numerous systems and accounts. Some of them are low priority, others could cause serious harm to a company if discovered (don't you just love power?).

Simple, easy to remember passwords just aren't acceptable. The only option is complex, hard-to-remember (and type) passwords. So, what do you use to keep track of your passwords? Do you use a program to encrypt them for you (requiring yet another password in turn), or do you do something less complicated such as a piece of paper kept on your person, or is it somewhere in between those options?

share|improve this question

40 Answers 40

up vote 61 down vote accepted

KeePass is great.

share|improve this answer
3  
+1 for Keepass. I have a copy of it on my laptop and a synched copy on my G1 Android. –  KPWINC Jun 7 '09 at 6:02
1  
KeePass + Dropbox = Autosyncing passwords. –  Hello71 Sep 14 '10 at 2:21

I have tried many and for personal use, my favorite is LastPass (free, standalone or browser add-on).

Still looking for a solution for work and have compiled a list of requirements and possible solutions in another post.

share|improve this answer

I have a very simple way of dealing with passwords:

I don't like password managers, but I like crypto, so I take advantage of one-way hashes (md5, sha1, etc) and generate passwords using them.

How it works?

First, I choose a good long password that I will use everywhere. For example qwerty (don’t use that, just an example). Now for every site, your password will be the md5 (or sha1) of qwerty + site name. For example:

$ echo “qwerty http://www.facebook.com” | md5
9d7d9b30592fd43dd6629ef5c12c6e9a

$ echo “qwerty http://www.twitter.com” | md5
cdf0e74e19836efb20f29120884b988d

That way my password for facebook is 9d7d9b30592fd43dd6629ef5c12c6e9a and for twitter is: cdf0e74e19836efb20f29120884b988d

Both long and secure. If someone steals my twitter password he has no way to reverse back to figure out the other passwords. Plus, doing that you don’t need any password software stored (just the md5/sha1 binaries which come by default on Linux and are easy to find on Windows).

share|improve this answer
5  
Good, simple scheme. What do you do on sites that have limited their password fields to less than 32 bytes, just truncate? –  pboin Nov 14 '09 at 18:14
1  
that's a quite ingenious scheme! cool! –  Sander Versluys Dec 2 '09 at 10:33
1  
pwdhash <pwdhash.com/>; does something similar and it's available as a Firefox add-in. So if you're simply wanting to control passwords on the web, this is ideal. Also means you can use any PC as you don't need to carry your password database around with you. –  Chris J Jun 3 '10 at 11:22
8  
Won't this leave a trail of commands with your password in plaintext in the bash history? –  pufferfish Jul 1 '10 at 11:06
1  
You can have bash ignore commands by configuring HISTCONTROL, see: commandlinefu.com/commands/view/1512/… –  Matt V. Jan 21 '11 at 1:51

In the heads of several people. The really important ones are written on small pieces of paper, then stuck in small envelopes. We staple through the envelopes, so it's obvious if anyone opened it up.

share|improve this answer

I admin linux from a Mac OS X desktop / laptop / iPhone and SWEAR by 1password. Brilliant, frequent updates, rock solid. Can do password storage, generation, logins for web pages, secure notes. With DropBox you can easily sync across machines.

Worth switching to a mac just for 1password. http://agilewebsolutions.com/products/1Password

share|improve this answer

For those on Linux w/ Gnome, you should check out Revelation. Clean interface, applet for taskbar, easy to use. I love it.

Downside is that there aren't a lot of export options (to KeePassX for instance) that are very useful. Because being able to export your database can be important, I wrote a Ruby script for it once, which worked for me.

share|improve this answer

I'm using gpass (GNOME password manager). It's a small GTK application, requires master key to view all other passwords, uses blowfish for encryption and has the possibility of generating new passwords.

http://projects.netlab.jp/gpass/

share|improve this answer

For personal passwords, since I use multiple computers, I like the free online service Clipperz. Encryption is done client-side and stored remotely. For work-related, +1 for Password Safe.

share|improve this answer

I use a program called pwsafe on my desktop. If I need a password from somewhere else, I SSH over and use that.

share|improve this answer

Password Safe has solid encryption and a random password generator. Groups of passwords are then distributed as encrypted files based on who needs which passwords.

share|improve this answer

I'd like to +1 David Pashley's answer above ( i'm new here so need more 'reputation')
I have normally just used a text file encrypted with the different sysadmin's gpg keys and checked into our internal company subversion server. This made it easy to get the changes out to the other admins.

share|improve this answer

I was using the TIPAS service on twitter:

http://twitter.com/tipas/

But, for some reason, the twitter admins appear to have broken searching.

share|improve this answer

Network password manager is cool. Multi user, ACL per tree, audit on who accessed/changed what.

Complicated passwords tends to be short. Long password (>15) are stronger today, they still resist to rainbow tables and are a pain to brute force. So i tends more to do sentences: "Ireallylikemygmailaccount!" is tronger than "g{#é'4ùdfg", and you don't have to write it down to remember it. Moreover, importants things:

  • Will the password be stored securelly on the remote system ? Many web site store your password in clear and send it back to you when you don't remember
  • Is it send over an encrypted channel ? ftp account over wifi in clear is not secure...
share|improve this answer

I use automatic password generator 'apg' to provide a list of possible difficult-to-guess but easy-to-remember passwords. Like the following example:

wuWesvupt7 (wu-Wes-vupt-SEVEN)
quirrardAj9 (quirr-ard-Aj-NINE)
urf5Olmenoy (urf-FIVE-Olm-en-oy)
yebTywalAk5 (yeb-Ty-wal-Ak-FIVE)
TihekDuiRen8 (Ti-hek-Du-i-Ren-EIGHT)
Flyahit7 (Flya-hit-SEVEN)

I choose the one I like most and then I save it using 'pwsafe'.

pwsafe has the benefit that you can backup the password file easily and you can merge files in the case you have several computers.

Also, the password goes (by default) to the X clipboard so others can't watch it.

Being both tools command-line makes them easily accesable so you don't have to mess with GUI menus.

share|improve this answer

I've taken to using an IronKey for some of this. There are some passwords I just plain memorize, like the admin passwords I use every day. For those passwords that I have to know but use once or twice a quarter, putting it on a text-file on an IronKey USB drive works well. It now mounts on Windows, Mac, and Linux! Kind of like truecrypt, but more portable.

share|improve this answer

Password Agent has worked well for me.

share|improve this answer

iPhone + Handbase (encrypted database app).

I need something to keep passwords that moves with me. I need access to the passwords at home, at work and anywhere because I'm oncall 24x7 1 week in 2, and I don't stay at home when I'm oncall. I need to have access to passwords anywhere and any time. It's no good keeping them on a laptop when I'm at a restaurant in another city and the laptop is at home. I use PCs, Macs and Unix systems and move between them all day, so a Windows-only app, or a Mac-only app won't work for my needs.

I used to keep them in a Palm TX in Handbase (still encrypted), but moved to the iPhone recently which wasn't a good move. The iPhone version of Handbase is a bit wordy, and takes much longer to enter data and retrieve it. And I had a One Time Password generator on the Palm, which I needed. I haven't found one for the iPhone yet.

I keep the database labeled something innocuous like Wine Tastings, so it doesn't look to enticing if I lost the device. The database is backed up. If I lost the iPod, the encrypted password database would probably get erased, and the company would buy another iPhone and I would restore the database.

However I remember about 100 of the most commonly used passwords. I only need to look up the less used.

share|improve this answer

I would recommend PasswordVault

A group in our IT Department use it and really like the features it has to offer.

The passwords are always encrypted. Individual users can choose what passwords to share. Best of all the software is free.

Whatever you decide to use make sure the OS is secure and that the passwords are encrypted.

share|improve this answer
1  
Shouldn't the link say PasswordVault? –  David Pashley Jun 7 '09 at 7:13

If you have OS X systems as your client workstations, you can use the Keychain Access program to manage passwords. We use a keychain file in a shared location accessible by system administrators and just link it in to our Keychain Access program.

share|improve this answer

We use SplashID. Works on my desktop and WM phone. It's the only one I have used and I like it.

share|improve this answer

We use CyberArk, as we needed a PCI compliant solution (and we have HIPPA needs too), plus it is almost all customer systems. I'm not thrilled with CyberArk, but it does work.

share|improve this answer

In a prev. life, when I had to "remember" 20 different passwords for various environments with different password-generation rules for each one, I used Whisper32. It did the job well enough.

share|improve this answer

I use Passkeeper. It's simple, free, lightweight and doesn't require installation.

share|improve this answer

KeePassX is a cross-platform KeePass alternative. A very nice (Qt) GUI and almost identical functionality.

Ehtyar.

[edit] Forgot to mention it supports KeePass DBs [/edit]

share|improve this answer

I just have a spreadsheet at google docs with the data.

share|improve this answer
4  
I'm not usually one to knock SaaS, but putting your passwords on an outsourced platform seems quite the wrong thing to do. –  Dan Carley Jun 8 '09 at 11:25

To help remember passwords I find that it is useful if they are pronouncable so you can at least say them.

I keep a list of a few passwords that I commonly need in my wallet. Not 100% secure but I think it's unlikely to cause any major issues.

The master list of all passwords is kept in a fireproof safe.

share|improve this answer

I use 1Password from Agile Web Solutions. It integrates seamlessly with all common browsers on the Mac and with the help of Dropbox, I can access the same password collection from all of my machines.

If you need to access your secrets from different OS platforms, KeypassX is a good choice.

share|improve this answer

I have a photographic memory, I can remember passwords to zip files I created in the 80s - not actually as cool as you might think :)

share|improve this answer

for personal passwords, I use PassPack.

share|improve this answer

Keychain. I've tried 1password, but keychain does what I need it to do, and I like the way it works better.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.