Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm interested in best practices and potential open source projects that would allow my organization to securely store multiple passwords and allow multiple administrators to access them. I'm interested in something that would allow each administrator to have their own login/key versus the typical password protected Excel spreadsheet. ;)

Preferable would be a web based application which I can run over SSL.

I need it to run in a Mac/Linux environment - no Windows apps, please.

Thanks!

share|improve this question
3  
dupe: see serverfault.com/questions/10285/… and others.. –  Toto Jun 16 '09 at 19:32
2  
I forgot to mention that I need a solution which will run under Linux. No Windows apps, please :) –  Aaron Brown Jun 16 '09 at 19:34
    
I too have that problem, we have quite a couple of systems we need to use that are from our vendors, right now we are using a gpg encrypted file, but that means that every admin has access to every password - not good. I'd rather like something that let's me define access lists for different sites (passwords) to different people in our team, be it a CLI, desktop or web tool. Password management for 3rd party apps is something that really needs elaboration. Care to create a communiy wiki entry maybe we can work out the requirements for it in a better way –  Server Horror Jun 16 '09 at 20:30
    
It looks to me like there is no really good solution out there to handle authenticating multiple administrators to access a common store of passwords. That kind of shocks me. Maybe I'll just have to write one. –  Aaron Brown Jun 18 '09 at 12:21
1  
Exactly, when you have multiple systems administrators, there needs to be a way to control who has access to what as well as remove their access without changing every key/password. It's also for auditing - who accessed what password and when. –  Aaron Brown Jun 18 '09 at 17:50
show 3 more comments

9 Answers

We use this : http://sourceforge.net/projects/phppassmanager/ (a little bit modified/tuned)

It's installed on a HTTPS web server with Active Directory authentication to restrict password retrieval to our team. Each member of the team knows a master password used to encrypt all the passwords stored in phppassmanager. They use it when they want to add/modify/read a password. The passwords are stored encrypted in a mysql database.

They potentialy have access to all the passwords but each password decryption is loggued, and the logs are shown to the whole team on the main page. This system is self-monitored and self-managed.

share|improve this answer
add comment

For what I read so far, any wiki system with database backend (even with file store backend, but I'd prefer db) should solve your problem. Setting proper restrictions on the user accounts, and only the people you trust (admins) will be able to read/modify the pasword lists (in a plain html doc :) ).

Put it behind SSL enabled server, and restrict the access to the database.

share|improve this answer
    
This would do fine if there was a robust audit trail and reporting mechanism. when someone leaves the organization I want to run a report that shows me all the passwords that have to be changed. Something like an SSL-protected wiki is a nice idea, but it needs to have a bit of a password-specific schema, to my mind, so that it can easily facilitate reporting. –  Evan Anderson Jun 16 '09 at 22:19
1  
@Evan, perhaps you should update your question to include this requirement. –  Zoredache Jun 17 '09 at 0:40
    
Evan wasn't the one asking the original question... –  Kamil Kisiel Jun 17 '09 at 21:25
add comment

I use KeePass and i'm very happy with it. It's an opensource easy to use password manager.

share|improve this answer
1  
It's windows and only allows a single login. I need a multiple-login solution so each sysadmin can log in separately, which is the only manageable and secure way to handle this. I'm shocked that there aren't tons of products out there that do this. –  Aaron Brown Jun 16 '09 at 20:25
1  
Oh, I'm wrong - KeePass has been ported to other platforms –  Aaron Brown Jun 16 '09 at 20:27
    
yes, KeePass has been definatly ported to other platforms. –  Paul Jun 17 '09 at 13:07
add comment

What exactly are you protecting with this system? Systems you control, or systems run by third parties?

For internal authentication, systems like Kerberos, LDAP or even just sudo and PKI can handle this.

For external authentication, say to a software support website, you're largely hamstrung by whatever system they implement. Tools like KeePass (2.0 kinda works with mono) or PasswordGorilla can store your passwords. I don't think either of them supports any notion of multiple separate decryption passwords; I'm not sure how that could work mathematically.

share|improve this answer
    
LDAP and kerberos are authentication systems, not password management systems. I need a way to store root passwords, router passwords, LDAP Manager passwords - any of the 8 billion passwords that a systems admin needs to juggle. –  Aaron Brown Jun 16 '09 at 19:57
    
Yes, yes, they are authentication systems. You use them to implement Single Sign On without the hokey excel spreadsheet. –  jldugger Jun 17 '09 at 1:27
    
I'm not sure you understand. Not everything can be hooked up to a single LDAP or kerberos server, nor should it. Server root passwords, for example, should never be stored in LDAP, nor should router enable passwords. –  Aaron Brown Jun 17 '09 at 21:11
    
Do it right, and you don't need a tool to streamline access to those passwords. Yes, if the network is down, your systems likely need some internal authentication. But in the case of servers, why not just use sudo and PKI? No root account, clear auditing, and not network dependent. –  jldugger Jun 18 '09 at 6:40
    
We do use LDAP and sudo with a PAM module where we can. There are still a dozen other accounts to deal with. Additionally, there needs to be documentation of the root account passwords, and not everything can be hooked into an LDAP system. Also there are accounts that need to be around in the event that LDAP is unavailable and we need to get into the systems. I appreciate that you think you have a better way, but we already do use centralized authentication where it is practical and possible. There are still multiple sysadmins that need to be able to access passwords occasionally. –  Aaron Brown Jun 18 '09 at 11:17
show 3 more comments

PowerBroker is a vendor product designed specifically for controlling/auditing access to shared accounts; however, there is a significant per-host license cost.

share|improve this answer
add comment

I worked at very security-conscious company, and on my team of 5 we used KeePass, because the encryption is strong, it is cross platform and supports importing multiple databases into your own. We stored it on a system that was only accessible through the internal network through SSH logins that required key authentication (no passwords, thanks!).

share|improve this answer
    
Are the keys encrypted? –  jldugger Jun 18 '09 at 6:38
    
The public key was the only thing pushed out to systems. The private keys remained on individuals' workstations. –  jtimberman Jun 18 '09 at 16:03
add comment

We use keypass It's quite a cool piece of software, you can organise passwords by catagory. However, I am unsure if you can have different levels of users to log on.

share|improve this answer
add comment

I'm not exactly sure it's what you need, but this works for us: we keep in our SVN a gpg-encrypted text file with all the credentials, encrypted with a common key which we all share. The main advantages to this approach instead of keepassx or similar tools are : 1) one can put free-form information there and 2) gpg --decrypt can be sent to a pipe and used in a terminal.

Sure, this only works for a group of ~10 people, but with a bit of delegation can be scaled up a bit. Also, we actually have two keys and two encrypted files for different access levels, but this doesn't change much.

Oh, and we tend to stay away from handling passwords as much as possible (mainly with personal SSH keys).

share|improve this answer
add comment

I am looking for the exact same thing, and I found 2 that might fit your needs.

Web-KeePass - This seems like it would do what is needed, but I'm still trying to figure out all the options.

corporatevault - It is very basic and in the early stages. The interface isn't finished, but I found it pretty easy to figure out.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.