Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I always wonder how do they manage many different passwords in an organisation.

I work in a company of 20 and find it very difficult to protect applications using passwords. Employee A comes in for a job. I give him the password for the sales email ID. Suddenly he leaves the job after a week. Then I change the password of the email again. Employee B joins in. He gets the newly assigned password. And so on.

This is just for email. The most crucial part comes where many different third party services are involved and each service having a password. Right now, I am the only one in the company to have all those passwords and I don't even dare to share them with others. That includes the web server logins, web host logins, ISP logins, VOIP logins and many more. What will happen in case if I am dead tomorrow? Definitely the services are going to be interrupted and it may take a while for all the paperworks to be done by the management to get back the accesses. In worst scenarios like the in-house web servers, it's even very difficult to get back the acccess without my presence.

What would be the right way to manage accounts? How they do it in big organisations? This has always been a question with no right answer, at least for me.

share|improve this question

migrated from stackoverflow.com Dec 25 '09 at 1:15

This question came from our site for professional and enthusiast programmers.

1  
Try Keeppass and try serverfault.com –  Jay Riggs Dec 25 '09 at 1:09
    
@Jay: Did you mean KeePass? keepass.info (And there's clones for other OSes too.) –  Roger Pate Feb 10 '10 at 19:59
    
@Roger - yes I did. Unfortunately I can't edit my comment. –  Jay Riggs Feb 11 '10 at 21:34
add comment

2 Answers 2

up vote 6 down vote accepted

Centralizing accounts. The new guy should use his own unique personal account and you would assign his account permissions to use the sales email thingie - not distribute more passwords to the poor guy.

This is not an easy goal to obtain especially with a lot of third party services, but it's the one I'll always strive for. You can mask single-password external servers by using various proxies on the inside as well, letting authenticated individuals through without them knowing what that service password is using.

VOIP should be easy enough to integrate with a central authentication mechanism. Always strive for a single place where accounts and passwords are managed - use LDAP integration and other synching methods at all times and at any cost (imo). Access should be decided upon assigned roles, not individual passwords or accounts.

Of course, have the routines you need to perform written down somewhere. If all else fails have some master passwords written up inside a safe which only some managers have access to if something would happen to you - though most passwords can always be recovered/reset by a call to the third party by a manager, or by physical access to a local server.

share|improve this answer
    
Thanks! That gave some idea on how to go about. –  Nirmal Dec 25 '09 at 2:45
1  
I'd be interested to know more about the practice that you mentioned here: "You can mask single-password external servers by using various proxies on the inside as well". How? What kind of proxies are those? –  Wesley Dec 25 '09 at 18:21
    
+1 for writing the passwords down and putting them in a safe. Don't be like Terry Childs. Get over yourself, write the passwords down and give them to a select few high-ranking officers in the organization. –  Wesley Dec 25 '09 at 18:22
1  
Just an example but if you have an external web site with a shared login, you could do a small page on the intranet that posts (or whatever) that login credential without notifying the user while redirecting to that site. All the user knows is he or she gets the link to this external web site on his or her personal intranet page - and behind the scenes this credential-posting and forwarding page does its own authentication before proceeding. –  Oskar Duveborn Dec 25 '09 at 19:23
    
Gotcha, thanks for the clarification! –  Wesley Dec 25 '09 at 21:47
add comment

Password management programs such as Secret Server or Password Manager Pro would come in handy for large organisations. KeePass is nice, but impractical when you have much more than a few members that need access to certain passwords, but maybe not have access to others. You could divide your passwords amongst multiple files -- but then you have to manage the passwords for the files themselves and there's no auditing and it's just a big mess. Centralized password servers are the way to go once a certain level of complexity is reached since you can restrict what users can see which passwords based on roles and etc. The web department used Secret Server at one organisation I worked at with seeming success.

share|improve this answer
    
Thanks for writing about the Secret Server. Looks interesting. –  Nirmal Dec 25 '09 at 2:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.