Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How does your company make sure all required employees have access to their (shared) credentials for client applications, company systems and third party applications?

For example:

  • Administrative credentials for a already deployed web application
  • Credentials for a third party website / application, such as a SSL provider
  • Credentials for inhouse applications
share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

At small companies I've worked for we've usual created an encrypted file containing shared accounts with the program Password Safe. Password Safe will give you some added benefits like automatically clearing the password from the user's clipboard and relocking itself after a period of time.

However, at larger organizations that have to comply with various security standards (PCI, GLBA, HIPAA, etc.) shared credentials are one of the things the auditors will get fairly uppity about. You're better off setting your applications up to authenticate against LDAP or RADIUS. Having 1 shared login for administrative access can lead to an internal threat doing something stupid before quiting or other nefarious uses.

Ivan's comment mentions KeePass which I've known some organizations to use and like. I personally havn't used it more than a few minutes, but people who like Password Safe's function but dislike its interface tend to like KeePass. He also suggested LastPass which adds functionality like automating webforms, I haven't tried it personally but it looks like something I may try out and home and possibly work.

share|improve this answer
1  
I agree, and it can be a nightmare if a user decides to change a password... LDAP is a great choice if available, and acting as an OpenID provider, you're all set. Another program like Password Safe is KeePass, which I've been running for several years (until I found LastPass). –  Ivan May 13 '09 at 15:11
add comment

For all size companies I have been a part of a team. We work very hard to have individual login to everything. We then used some single sign on technology to mange all of the logins for us. These systems can be expensive and require hours to maintain.

Recently I have found a program that uses strong encryption, we have forced all our passwords into this program to the point where if I don't have PINs then I am not able to get anything done. Some would say this is dangerous, but if a separation needs to take place then the heartburn of discovery is lessened.

http://www.mirekw.com/winfreeware/pins.html..this tool is awesome and would fit your needs easily.

share|improve this answer
add comment

We don't allow our people to have shared accounts. However administratively sometimes it isn't possible to have multiple account to vendors - like you said for ssl certs, etc it's more of a nightmare to track who's account that is associated with. For those cases we simple have a set of "Systems" passwords, that aren't written down anywhere and have codewords or triggers we use when communicating them to the other Systems personal. The codewords are generic and cannot be used to guess the password but we all know the password associated with it.

For example the password would be created using the Condense a phrase and add numbers and non alfanumeric charicatars such as:

"Windows Blinds are a Good thing to have" would become WbRg!th@ and the code word would be "The Window Password"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.