Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently work at a small company that manages system administration tasks for a variety of clients. We do our work mostly remotely and we are encountering that the data to all our clients system's reside mostly on the heads (sometimes postit notes) of our team. We have a paper form in which to put all this information but it is rarely kept up to date. When one of these persons is not available, the other's can't even ssh to the client because the passwords are nowhere to be found. We mostly need to store information regarding:

  • Network infrastructure. IP space, subnets, dns, gateways, routes.
  • Server infrastructure (ips and what they do). E.g. what is the smtp server, what is the ip address. What is the asterisk (PBX) server, IP address.
  • Passwords for all relevant servers and services we have been commissioned to support.
  • People in the company. Local IT manager support. Local administration support.
  • Phone numbers of relevant people in the organization.
  • List of changes that we have done there (like a CRM tool).

All this information would have to be stored on a per client basis. Eventually we want that certain groups have only access to certain clients, so access control on a per client basis would be nice.

My questions is what solution (or solutions) do people usually use in this situation?

share|improve this question

3 Answers 3

We have a keepass datafile (to which those of us with authorisation have a keyfile) which stores the relevant credentials, in a small source control project. Extra detail is sometimes kept in the keypass notes field(s), or if it is more than something as small as a couple of IP addresses (and the information is not sensitive) such the detail is in small documents (a text file usually) along with a couple of documents in that same project.

There is another keepass database with more sensitive details in, that less people have access too. Depending on the size of your operation and the nature of your clients you may need to break things down much more finely than we do.

I find this works fairly well when people bother to use it (I sometimes get annoyed with conversations that go: "What is the VPN password for X? It is in keypass. Oh, what address do I need for the SQL server at that end? Check keypass. And the SQL user/pass? All in keypass. OK. And what about the web server?...").

share|improve this answer
1  
The advantage to this is if you ever go on site, you can take a copy of the file with you on the laptop. –  SpaceManSpiff Aug 9 '09 at 7:51
    
Be careful when going onsite with a keepass store (or similar) not to keep the store and the key-file (and/or passphrase) on the same drive/machine. Otherwise if you accidentally leave your USB drive with it all on behind you'll have to mess around changing all the credentials stored there-in in case someone finds them, works out how to access them, and tries to go play... –  David Spillett Aug 15 '09 at 10:58

We use ssh-keys with one password on all our servers. We change the password every couple of month.

We also use a wiki as a knowledge database (I would recommend doku-wiki) and trac as a ticket-system.

share|improve this answer
    
+1 despite believing that Trac is a really, really bad trouble ticketing system. –  womble Aug 8 '09 at 22:08

Set up a basic wiki and pgp/gpg-encrypt the document/documents with such info. Set the client(s) up with the FireGPG firefox plugin. You can even mix inline encrypted sections into a plain-text wiki page and it'll take care of decrypting it for you.

Just make sure you encrypt documents to yourself (in case the client loses their key), in addition to whoever needs access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.