16

I'm interested in best practices and potential open source projects that would allow my organization to securely store multiple passwords and allow multiple administrators to access them. I'm interested in something that would allow each administrator to have their own login/key versus the typical password protected Excel spreadsheet. ;)

Preferable would be a web based application which I can run over SSL.

I need it to run in a Mac/Linux environment - no Windows apps, please.

Thanks!

8
  • 3
    dupe: see serverfault.com/questions/10285/… and others..
    – Toto
    Jun 16, 2009 at 19:32
  • 3
    I forgot to mention that I need a solution which will run under Linux. No Windows apps, please :) Jun 16, 2009 at 19:34
  • I too have that problem, we have quite a couple of systems we need to use that are from our vendors, right now we are using a gpg encrypted file, but that means that every admin has access to every password - not good. I'd rather like something that let's me define access lists for different sites (passwords) to different people in our team, be it a CLI, desktop or web tool. Password management for 3rd party apps is something that really needs elaboration. Care to create a communiy wiki entry maybe we can work out the requirements for it in a better way Jun 16, 2009 at 20:30
  • It looks to me like there is no really good solution out there to handle authenticating multiple administrators to access a common store of passwords. That kind of shocks me. Maybe I'll just have to write one. Jun 18, 2009 at 12:21
  • 1
    Exactly, when you have multiple systems administrators, there needs to be a way to control who has access to what as well as remove their access without changing every key/password. It's also for auditing - who accessed what password and when. Jun 18, 2009 at 17:50

11 Answers 11

3

We use this : http://sourceforge.net/projects/phppassmanager/ (a little bit modified/tuned)

It's installed on a HTTPS web server with Active Directory authentication to restrict password retrieval to our team. Each member of the team knows a master password used to encrypt all the passwords stored in phppassmanager. They use it when they want to add/modify/read a password. The passwords are stored encrypted in a mysql database.

They potentialy have access to all the passwords but each password decryption is loggued, and the logs are shown to the whole team on the main page. This system is self-monitored and self-managed.

2

I use KeePass and i'm very happy with it. It's an opensource easy to use password manager.

3
  • 2
    It's windows and only allows a single login. I need a multiple-login solution so each sysadmin can log in separately, which is the only manageable and secure way to handle this. I'm shocked that there aren't tons of products out there that do this. Jun 16, 2009 at 20:25
  • 1
    Oh, I'm wrong - KeePass has been ported to other platforms Jun 16, 2009 at 20:27
  • yes, KeePass has been definatly ported to other platforms.
    – Paul
    Jun 17, 2009 at 13:07
0

What exactly are you protecting with this system? Systems you control, or systems run by third parties?

For internal authentication, systems like Kerberos, LDAP or even just sudo and PKI can handle this.

For external authentication, say to a software support website, you're largely hamstrung by whatever system they implement. Tools like KeePass (2.0 kinda works with mono) or PasswordGorilla can store your passwords. I don't think either of them supports any notion of multiple separate decryption passwords; I'm not sure how that could work mathematically.

8
  • LDAP and kerberos are authentication systems, not password management systems. I need a way to store root passwords, router passwords, LDAP Manager passwords - any of the 8 billion passwords that a systems admin needs to juggle. Jun 16, 2009 at 19:57
  • Yes, yes, they are authentication systems. You use them to implement Single Sign On without the hokey excel spreadsheet.
    – jldugger
    Jun 17, 2009 at 1:27
  • I'm not sure you understand. Not everything can be hooked up to a single LDAP or kerberos server, nor should it. Server root passwords, for example, should never be stored in LDAP, nor should router enable passwords. Jun 17, 2009 at 21:11
  • Do it right, and you don't need a tool to streamline access to those passwords. Yes, if the network is down, your systems likely need some internal authentication. But in the case of servers, why not just use sudo and PKI? No root account, clear auditing, and not network dependent.
    – jldugger
    Jun 18, 2009 at 6:40
  • We do use LDAP and sudo with a PAM module where we can. There are still a dozen other accounts to deal with. Additionally, there needs to be documentation of the root account passwords, and not everything can be hooked into an LDAP system. Also there are accounts that need to be around in the event that LDAP is unavailable and we need to get into the systems. I appreciate that you think you have a better way, but we already do use centralized authentication where it is practical and possible. There are still multiple sysadmins that need to be able to access passwords occasionally. Jun 18, 2009 at 11:17
0

For what I read so far, any wiki system with database backend (even with file store backend, but I'd prefer db) should solve your problem. Setting proper restrictions on the user accounts, and only the people you trust (admins) will be able to read/modify the pasword lists (in a plain html doc :) ).

Put it behind SSL enabled server, and restrict the access to the database.

3
  • 1
    This would do fine if there was a robust audit trail and reporting mechanism. when someone leaves the organization I want to run a report that shows me all the passwords that have to be changed. Something like an SSL-protected wiki is a nice idea, but it needs to have a bit of a password-specific schema, to my mind, so that it can easily facilitate reporting. Jun 16, 2009 at 22:19
  • 1
    @Evan, perhaps you should update your question to include this requirement.
    – Zoredache
    Jun 17, 2009 at 0:40
  • 1
    Evan wasn't the one asking the original question... Jun 17, 2009 at 21:25
0

PowerBroker is a vendor product designed specifically for controlling/auditing access to shared accounts; however, there is a significant per-host license cost.

0

I worked at very security-conscious company, and on my team of 5 we used KeePass, because the encryption is strong, it is cross platform and supports importing multiple databases into your own. We stored it on a system that was only accessible through the internal network through SSH logins that required key authentication (no passwords, thanks!).

2
  • Are the keys encrypted?
    – jldugger
    Jun 18, 2009 at 6:38
  • The public key was the only thing pushed out to systems. The private keys remained on individuals' workstations.
    – jtimberman
    Jun 18, 2009 at 16:03
0

We use keypass It's quite a cool piece of software, you can organise passwords by catagory. However, I am unsure if you can have different levels of users to log on.

0

I'm not exactly sure it's what you need, but this works for us: we keep in our SVN a gpg-encrypted text file with all the credentials, encrypted with a common key which we all share. The main advantages to this approach instead of keepassx or similar tools are : 1) one can put free-form information there and 2) gpg --decrypt can be sent to a pipe and used in a terminal.

Sure, this only works for a group of ~10 people, but with a bit of delegation can be scaled up a bit. Also, we actually have two keys and two encrypted files for different access levels, but this doesn't change much.

Oh, and we tend to stay away from handling passwords as much as possible (mainly with personal SSH keys).

0

I am looking for the exact same thing, and I found 2 that might fit your needs.

Web-KeePass - This seems like it would do what is needed, but I'm still trying to figure out all the options.

corporatevault - It is very basic and in the early stages. The interface isn't finished, but I found it pretty easy to figure out.

0

I think sysPass is a good choice. It offers:

  1. Password encryption with AES-256 CBC.
  2. Users and groups management
  3. MySQL, OpenLDAP and Active Directory authentication.
  4. Multilanguag
  5. and so much more
0

Thycotic Secret Server.

We have been using this for many years at my company. It has a lot of greate features like automatically changing passwords, emails sent when certain passwords are accessed, etc.

They also provide regular updates and add features.

https://thycotic.com/products/secret-server/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .