Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Hello and I'm apologizing in advance if this question doesn't fit programmers section of stackexchange.

I'll try to clarify what the problem is by telling a story where the problem originates from. I'm working in a small company (8 people) where we have developers, sys admins and staff that handles day to day calls.

The problem is the logins. There are various logins, for example web server root login. Then there's MySQL login, login for apps that we develop and to make the thing even more complex - logins differ from local development and testing versions to the ones that are actually deployed which makes the whole thing even more messier. What's happening is that no one knows all of the logins, and they're either written down somewhere deep on cryptically named files or certain people know them by heart. If someone who knows the login for the thing we need to work with is away (say holiday), the process of retrieving the login becomes a huge mess.

Now, we are aware how terrible that is and we're looking into improving our login / project management. The other problem is that not everyone should know all the logins.

My question is: how do you (or how would you) handle storing logins such as web server root information, web app admin login etc. in such a way that it's available to everyone within the company, but with restricted access (say, a secretary cannot obtain root details, no offence to secretaries)?

P.S. I just spent 3 hours obtaining the login details to change a simple spelling mistake on a project which took exactly 1 second after I had the info. Seeing I can't afford losing any more nerves or time over such seemingly trivial things, I'm begging experienced and smart guys for help. Thanks in advance :)

share|improve this question
add comment

5 Answers

up vote 6 down vote accepted

Almost every server product or product targeted toward businesses can use LDAP. I'd go so far as to say that it's irresponsible not to do it in this day and age.

Set up a directory server if you don't already have one, configure server products like mysql to use it, then update the authentication systems in whichever products you own the source for. One login for every app on the internal network.

Logins to vendor sites are another story but you don't really mention those. I wouldn't waste time maintaining an enterprise-wide password vault unless I absolutely had to; it's too easy to run into problems with sensitive information getting stored in the wrong place or low-level idiots forgetting the password to the password vault (or worse, writing it down on a sticky note and attaching it to their monitor). Even if the information doesn't seem all that valuable, I would only ever trust competent IT professionals with it. We use KeePass where I work but the database is in a restricted (Admin-only) location.

If everybody gets their own private password safe then that mitigates a lot of the harm (also a lot of the usefulness); shared password vaults violate non-repudiation and that is not a situation you want to be in when there's a major disaster and the auditors come a-sniffin'.

share|improve this answer
    
I like your answer, I did try KeePass before but we had issues with people either being lazy to update it or "someone" lost the file. No one ever paid much attention to KeePass before, and from what I can see by googling around is that we'll have to do it the way you described. Thanks! –  N.B. Aug 16 '11 at 13:02
add comment

You might want to look into a group password safe product, we use something called SecretServer for just this sort of thing. They also have an online version if you don't want to host it yourself.

share|improve this answer
add comment

I personally prefer the unhackable solution, write the passwords on a bit of paper and put those in a secure place when not in use.(such as the company safe).

share|improve this answer
    
"Unhackable" doesn't necessarily mean secure. Social engineering can get where computers can't. Also, anytime you make a security measure too frustrating, you encourage people to bypass it. "Dang, I have to walk to the safe again? I'm just gonna copy this and put it in my desk..." –  Nathan Long Aug 16 '11 at 15:19
    
+1 for write passwords on paper. –  David Cary Jul 6 '13 at 6:55
add comment

Assuming you have some sort of local network domain, setup users and groups for each person in the company for that domain. This will be the main-login for every person. On some shared network drive, create folders for each group and restrict access to them for groups and individuals. In these folders, you can store the password-lists and make them accessible only for people who are in a certain group or should've access as an individual.

Alternatively, if your source control system supports it, have the password documents under source control and apply the same scheme of users and groups to repository locations. Then anyone belonging to a certain group can access all the passwords he/she needs.

You can also try to employ technologies like LDAP or buy a software solution for your company, there're lots on the market. A quick google search turned up with this for example.

share|improve this answer
add comment

Write an app that stores passwords.

Each user should be able to create a login/password combo, and share it with any other user. Nice-to-haves would be features like user groups so that you can share with other admins, etc.

If that sounds like too much work, buy a product.

share|improve this answer
1  
Saying buy a product doesn't help much since I've no clue which product does what I need, developing one is an option but then again - it needs its planning. If there exists something that rectifies my problem, I'll gladly pay for it. If you know of any such products, I'd be glad to check them out. –  N.B. Aug 16 '11 at 12:36
    
Try google. 'corporate password manager' brings up plenty of relevant results. –  Kirk Broadhurst Aug 16 '11 at 12:45
    
The point of asking at SO was so I can see what people in my field use. Googling for such term can often yield results for crap software (and incidentally it actually does that!). Thank you for your input but you really haven't told me what I didn't try myself. –  N.B. Aug 16 '11 at 13:00
    
@N.B. So you meant to ask 'which product should I buy to manage my passwords'? I can edit the question for you if you'd like... You asked 'how should I do it', and my suggestion is to figure out what you need & then write an app. –  Kirk Broadhurst Aug 17 '11 at 3:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.