Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for web-based "vault" for storing client passwords that multiple users can access. Not a password manager, But it should be secure, password-protected online storage of one or multiple files.

share|improve this question
1  
Do you intend to host it yourself or are you looking for a provider of such a service? –  Dan Carley Nov 9 '09 at 10:12
add comment

3 Answers

Clipperz is one that I've considered before, but not yet got around to testing myself. There is both a hosted version and a source download and install on your own web server.

Being open source (at least for the most part - I don't know for sure if the downloadable version is identical to the F/OSS one or if there are extra features) has the advantage that if you care to do so you can inspect the code to ensure that it is at least trying to be as secure as it claims and not just using ROT-13!

share|improve this answer
add comment

(This isn't so much an answer as a "Gee, I'd like that, too" statement. I'm marking it Community Wiki, as such.)

I have yet to find anything that does what I want. If you're planning to use this in any multiuser capacity (other than for personal password management), I suspect you'll find that you want the features I want, too.

The piece that I see missing in all of the password storage systems I've ever found has been the ability to produce an audit trail of password access by a given user. Every password manager I've run into assumes some kind of single authentication to access the database, and doesn't maintain a log of database access per-user.

Consider the scenario: When I worked for a "managed IT services" Firm, years ago, we kept each Customer's passwords in a Customer-specific "Password Safe" file with a unique password (kept in another "Password Safe".) Technicians going out to Customer sites for the first time would request the Customer's "safe password" from their manager, and would thenceforth have access to all the passwords in that Customer's file.

When we technician left the company, it would be necessary to change all the passwords referenced in the Customer's file, since the departing technician could've absconded with any version of the file. We kept an audit trail of which Customers they had access to (so that we didn't have to change all passwords across all Customers), but it was still a hassle.

I'd like to see a web-based tool, back-ended to LDAP for authentication, that allows for password storage / retrieval over an SSL connection in a browser. I want reporting functionality to answer the question "Show me all the passwords that a given user has accessed that have not been subsequently changed" so that I can have a list of the passwords that must be changed when that user is no longer permitted access (contract is over, leaves the company, fired, etc). I use the "managed services" metaphor above, but this would be just as critical in an IT shop with more than one person on staff. Having to change every administration password in every system when somebody leaves is a bad thing, IMO.

An additional "whiz-bang" feature would be an API to allow me to write back-end scripts to automatically change passwords in the real systems / devices and update the database with the new password. (Automatically rotate credentials in embedded devices that don't support distributed authentication via script, etc...)

share|improve this answer
add comment

Passwordstate may be of interest to you - it allows secure storage of passwords for individuals, or for sharing amongst teams of people. Full auditing against individual Active Directory accounts, both for changing and viewing passwordords. Plenty of other features as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.