Ask Slashdot: Open Source Multi-User Password Management?

An anonymous reader writes "I work in a network environment that requires multiple people to have access to numerous Wireless Access Keys, iTunes/iCloud accounts/passwords, hardware appliance logins, etc. I'm attempting to replace the ever popular 'protected' excel spreadsheet that exists in almost every network with all usernames and passwords just waiting to be discovered. Are there any open source, multi-user, secure and preferably Linux-based password management tools that the Slashdot community would recommend?"

Comments

passpack works for me

[Anonymous Coward]

Ive been using passpack.com it's been okay, although looking for something cheaper for the value..

Re:passpack works for me

[Heebie]

Doesn't that mean you are trusting a third party with all your passwords? Not something I'd want to be doing. :/

lol

[Anonymous Coward]

lol

Better than the last place I worked at

[Hamsterdan]

It was all done on a network drive in Notepad. (Ironic thing is it was a security-related department)

Re:Better than the last place I worked at

[Anonymous Coward]

If only there was +1 sad..

Re:Better than the last place I worked at

[jtownatpunk.net]

I once had a job where the list was kept on a printed page stored in a locked filing cabinet (no, it wasn't in the basement).

Re:Better than the last place I worked at

[Anonymous Coward]

Was it in a disused lavatory with a sign on the door saying 'Beware of the Leopard'?

Re:Better than the last place I worked at

[rwa2]

Heh, the best thing that I could come up with in a Wintel-centric environment was an encrypted zip file containing an excel spreadsheet. The master password would be periodically rotated and sent to people in an encrypted email.

We had access to Keepass or something similar, but our management couldn't be bothered to install it from the depot :P

Re:Better than the last place I worked at

[rwa2]

Oh yeah, but it sucked because opening an excel spreadsheet in a zip file would cause it to be extracted to the temp dir first :P

Re:Better than the last place I worked at

[forkazoo]

We use phpchain at work for this sort of thing. A few hundred accounts for various servers, devices, vendor support accounts, and logins for accounts at companies we work with. All stored securely. Google it if you arent familiar with it. It has been a huge win for us, and does everything asked for. We even wrote a simple search functionality for at that I think has been rolled into mainlIne at this point. Certainly better than a plain text file on a shared drive!

(tried posting this previously, but I wasn't logged in. Trying again now that I have gotten home. Hopefully it is more noticeable now.)

Re:Better than the last place I worked at

[mortonda]

And the lights were off, and the stairs were broken!

Re:Better than the last place I worked at

[halfnerd]

Can you actually share a password with several users using phpchain? It seems to me like everyone only has access to their own passwords.

Re:Better than the last place I worked at

[Anonymous Coward]

Last thing i used was gpg encrypted text files stored in an svn repo. One plugin for VIM and you are done :)

Re:Better than the last place I worked at

[Prosthetic_Lips]

When our last SysAdmin left, he left us an unencrypted Excel file of passwords. Since he used it as his central repository of passwords, not just for our local group that he was supporting, that gave us several passwords that were outside of our control. It actually has come in handy; previously we had to request some changes from IT (e.g. a DNS change for a staging website), and now we are able to do that ourselves.

Of course, an Excel file on a shared drive would not be my suggested solution! And if you think Excel's password capability is useful, I'd suggest doing a Google search -- there are a LOT of programs that can crack that. I've had to use one, on a spreadsheet that was read-only without a password that a previous employee left us. It took all of a few minutes for the program to come up with a solution. Passwords that only keep the good guys out are not worth it.

Re:Better than the last place I worked at

[qubezz]

It sounds like the asker is in an enterprise windows network. What you might use yourself is different from what you replace an Excel spreadsheet with on your company's network.

I have deployed and administered Network Password Manager. A bland name for a very good Windows-only password manager. It has a real client and server, AES encryption, lets you create a tree of passwords, and access control to different parts of the tree is done with active directory, meaning you can let an "accountants" and/or "bookkeepers" group in your directory have read-only access to a tree "financial passwords", and a "managers" group or particular users can have modify or admin access to those passwords. This means you can just update personnel changes in active directory instead of having another program where you must update rights for every user. On dismissal, you can review passwords that the user had access to and reset just those apps/sites. Individual users can also have their own tree for their convenience that nobody else can access, although If I recall, the system admin can see all passwords.

This degree of rights control is very useful when you run several different programs on your own network with different user accounts, along with vendor account sites (ordering, financial, billing, shipping, etc.) where you have to bend to another company's account and password system, which might give your whole company only one or a few logins.

For my own stuff, I have text files (both flat and encrypted), passworded Firefox password manager, and Blackberry Password Keeper. A $50 Blackberry (with no SIM card if you have something to hide) makes for a better password device than anything purpose-built you can buy; with encrypted disk storage, encrypted password storage, and no-touch USB backup, it is pretty secure - you can set it to wipe itself if a bad password is entered just three times, it can take different passwords to unlock the device vs getting to password keeper, you can install "decoy" password apps, and there are no biometrics that can bypass protection (showing it a picture of you, or using your removed fingers or eyeballs).

Re:Better than the last place I worked at

[VortexCortex]

We use phpchain at work for this sort of thing.

Uhm. You are aware that using PHP for anything security related is like making a vault door out of lit sticks of dynamite, right?

Re:Better than the last place I worked at

[dave420]

Incorrect.

Re:Better than the last place I worked at

[History's Coming To]

It's not a bad idea in principle, I have a client which has lots of outlets and each uses around 10 different login for various services, I supply them with a printout each month and they keep it locked in a safe at head office. There's also a little encryption on it to stop casual usage (the passwords aren't the real passwords, they've been altered using an algorithm that only two company directors know).

Of course, a filing cabinet isn't the best option, Feynman proved this by breaking into many of them at Los Alamos and leaving little notes. Instead of changing the security systems the military put out a memo saying that Prof Feynman was not to be left alone with a filing cabinet.

Re:Better than the last place I worked at

[Spiked_Three]

It was a question, it therefore can not be incorrect.

If you are referring to the questions assumptions, perhaps it would be better phrased as 'statistically, people who use php write horrible code from a security perspective, most of the time'.

Re:Better than the last place I worked at

[forkazoo]

We just use a shared account for "engineering department (location XYZ)" passwords. You can also have an individual account if you want to have private passwords, and you could put the password for any shared phpChain accounts you need to access in your private phpChain account. We have it running on an internal server, rather then something exposed to the Internet, so the danger of a breach is minimal. (If anybody makes it that far, we are already hosed.) But, the passwords are all stored in an encrypted form, so we could safely send backups offsite if we needed to, etc. Also, you need to log into the page with a normal HTTP login (which is tied to the NIS account you use everywhere on our network) before you log in with the shared phpChain account, so we have an audit trail wrt which individual person accessed what, despite using shared accounts.

Re:Better than the last place I worked at

[forkazoo]

Uhm. You are aware that using PHP for anything security related is like making a vault door out of lit sticks of dynamite, right?

There is nothing inherently dangerous about PHP. But, the phoChain login page is secured behind a normal HTTP / Apache login. So, we have it set up so you have to be logged in as a valid user before you can even see the phpChain login page. It's also on an internal server, so it can't be accessed from the Internet. (Or, if you can, we have far greater security concerns to take care of first!)

Lots of very large web sites use PHP in public facing applications every day. From what I understand, that includes Facebook. While it's easy to make vulnerabilities in PHP, there isn't any language where it is especially difficult to make them. In general, you introduce vulnerabilities in proportion to the amoung of pieces that are in motion. Something like phpChain really only does a few small things, so it is easy to see how every feature interacts with every other feature. Compared to something like Wordpress, something like phpChain is much easier to get right. It doesn't need to give content to untrusted users. It doesn't need to interoperate with other sites. It doesn't need feeds or pingbacks. It doesn't support public comments. It doesn't do embedded flash. It doesn't need a full SQL backend. It just stores some passwords. And, it does it well.

Re:Better than the last place I worked at

[Mr. Slippery]

'statistically, people who use php write horrible code from a security perspective, most of the time'.

True. However, it's also true that statistically, people who use C++ write horrible code from a security perspective, most of the time. And people who use Perl write horrible code from a security perspective, most of the time. And people who use Java, Python, COBOL, etc., write horrible code from a security perspective -- indeed, horrible code in general -- most of the time.

There is not now, nor will there ever be, a language in which it is difficult to write bad programs.

Re:Better than the last place I worked at

[Coren22]

NPM looks interesting, personally, I implemented Password Safe: http://passwordsafe.sourceforge.net/ unfortunately, it does not handle multiple users, though I suppose you could have multiple files with different passwords and a master file with all the passwords.

Re:Better than the last place I worked at

[Anguirel]

There is not now, nor will there ever be, a language in which it is difficult to write bad programs.

Don't be silly... there are plenty of languages where it's difficult to write any program.

Re:Better than the last place I worked at

[Spiked_Three]

haha, good point. I'm glad you left c# out of it :)

Wallet

[tskirvin]

Wallet is a Kerberos-based secret management tool. It works well for me.

Re:Wallet

[miknix]

Gringotts is a secure notes manager for Linux and other UNIX-like systems. I've been using it to store passwords for more than three years.

KeePassX

[Anonymous Coward]

KeePassX (v1) comes in the Fedora and Ubuntu repositories, and has Windows binaries. You can use simultaneous key and password encryption (if you're worried about keyloggers, or if you have to share the password in an unsafe way). It can also generate passwords of varying complexity.

Re:KeePassX

[Anonymous Coward]

+1 for KeePass

I started using it in 2009 and haven't looked back.

It works great with my Ubuntu and Windows mix. I keep it on a USB drive.

Re:KeePassX

[Sam the Nemesis]

I keep it on a USB drive.

Better still, I keep my DB on Dropbox, so it is available anywhere I go - no need to carry USB pen drive.

Re:KeePassX

[rvw]

I keep it on a USB drive.

Better still, I keep my DB on Dropbox, so it is available anywhere I go - no need to carry USB pen drive.

I keep a master keepass file at my laptop. When I change it, I copy it to my dropbox folder, and there I even make two copies, one to my shared folder, which is shared with my work dropbox account. That means it is synced to my work computer as well. At work I use a different keepass database, and copy that to the same shared folder. I even sync it to the phone via dropbox, but on the phone I rarely update dropbox files. That means I have an old version of the database there. That isn't a big problem though. For most of what I need it's sufficient. When at work, I don't change the home master db, or I make a copy with a different name.

Re:KeePassX

[Rich0]

My main issue with KeepassX is that it isn't capable of running solely with an extension or bookmarklet, which means that it won't work on every OS I have. I use Lastpass as a result, though I'd prefer something equivalent that is open-source...

Delete the spreadsheet.

[Anonymous Coward]

I use post it notes - taped to my monitor. I just got tired of all my coworkers asking me for the passwords.

Re:Delete the spreadsheet.

[lewko]

I love having the password on my monitor. However I didn't like the appearance of all those Post-it notes stuck to it. So instead I changed all my passwords to "Samsung".

Re:Delete the spreadsheet.

[rvw]

I love having the password on my monitor. However I didn't like the appearance of all those Post-it notes stuck to it. So instead I changed all my passwords to "Samsung".

But what if you buy another monitor?

Re:Delete the spreadsheet.

[Prosthetic_Lips]

Or the IT department gets a new shipment in, and replaces yours during the night? You'll come in and none of your passwords work. "I keep typing Vizio and it doesn't work!"

Re:Delete the spreadsheet.

[mitchy]

Sorry lewko, had to steal this quote. It was just too funny to allow myself to forget it.

Re:Delete the spreadsheet.

[Anonymous Coward]

You didn't change on your /. account.
I just got it sent to my email, waiting for it...

Re:Delete the spreadsheet.

[lewko]

I look forward to the royalty cheques, but where have you used it?

KeepassX in a Dropbox folder

[DarkFencer]

KeepassX in a Dropbox (or some similar sharing) folder works great. More secure encryption than Excel and better for the purpose.

Re:KeepassX in a Dropbox folder

[Anonymous Coward]

If you need more security, you can also stick the KeepassX database file into a Truecrypt file volume.

Re:KeepassX in a Dropbox folder

[leuk_he]

Is it more secure?

Isn't it the same as a excell sheet with a master password on it?

(Ok, keepass is way cheaper than a excell sheet)

Re:KeepassX in a Dropbox folder

[Anonymous Coward]

Works great - especially since there's also an Android KeePassX client.

Re:KeepassX in a Dropbox folder

[Anonymous Coward]

Excel passwords are easy to crack, google for "advanced office password breaker".

Re:KeepassX in a Dropbox folder

[rvw]

Is it more secure?

Isn't it the same as a excell sheet with a master password on it?

(Ok, keepass is way cheaper than a excell sheet)

I wouldn't know if it's more secure. Do you trust MS on this? Do they have a backdoor? Okay, keepass could have a backdoor as well.

Keepass is better because it's designed for it. It has a password generation tool, and it has some handy options. You have a list of keys, possibly organized in folders. If you open a list, you can set KP to not display usernames and/or passwords. So if someone is looking over your shoulder, they cannot see your password. CTRL-C and you copy your password, and then you can paste it into a password field on a website. CTRL-B copies your username. CTRL-V enters username and password in web forms that only have those two fields. Sometimes it doesn't work, but if it does it's simple and great.

Re:KeepassX in a Dropbox folder

[Prosthetic_Lips]

+1

I had to "find" a password for an Excel spreadsheet from a previous employee, and it took 1 download and a few minutes to crack the password. NOT good password encryption from the boys in Redmond. Or, perhaps they were forward-thinking and were trying to give the gummit an easy back door....

Re:KeepassX in a Dropbox folder

[frodo from middle ea]

Okay, keepass could have a backdoor as well.

Keepass is opensource, if a backdoor existed, it would have been found out , reported , and closed for good. That's what open source is good at.

Re:KeepassX in a Dropbox folder

[PieterGen]

Keepass is opensource, if a backdoor existed, it would have been found out , reported , and closed for good. That's what open source is good at.

As a rule of thumb yes, but only if (!!) enough users / developers take the time to read the code and find anomalies.......

Team Pass

[dark12222000]

I've used Team Pass (site here) for a few months now. It works well enough. It's at least as secure as an excel sheet. It is however web based, so make sure to lock it down appropriately...

Re:Team Pass

[Anonymous Coward]

ewww.. php..

Re:Team Pass

[Anonymous Coward]

You're just upset that someone made a lousy CRUD app in five lines of code instead of 20 class files with dozens of lines of verbiage around five lines of code plus 50MB of framework libraries and activerecord requiring a small server farm of application servers to handle a few dozen simultaneous requests.

Of course, the app will probably shit itself the first time someone puts a ' in their password, or else return the wrong information for passwords containing \

Re:Team Pass

[Bert64]

Of course, the app will probably shit itself the first time someone puts a ' in their password, or else return the wrong information for passwords containing \

You're referring to sql injection or magic quotes, and those who rely on the latter to prevent the former.
If coded properly (ie using prepared statements for the db calls!) this won't be a problem, and it's just as easy to write poor code in other languages.

Re:Team Pass

[Anonymous Coward]

And you can ream your asshole out with the magnitude of worthlessness that is your piece of shit c sharp equivalent.

Keepass

[Anonymous Coward]

http://keepass.info/ light-weight and easy-to-use password manager.

Re:KeePass

[ArsonSmith]

sure wish webkeypass wasn't a pile of crap.

Re:KeePass

[Anonymous Coward]

I'm mostly satisfied with keepass. But yeah. Its a piece of crap. For the passwords of lesser importance, I resort to a txt file in my secured user profile, and I chnge them on a semi random basis. Its mainly about cost-of-usability.

Re:KeePass

[Anonymous Coward]

You can even store the password database on the cloud if you wanted...

Why is this a good idea?

Re:KeePass

[Anonymous Coward]

I agree and recommend KePass to keep credentials organized and secure; however,

I also recommend RemoteDesktopManager. For a small fee it has a secure central repository to store practically any access method within one database.

Re:KeePass

[Sam the Nemesis]

You can even store the password database on the cloud if you wanted...

Why is this a good idea?

What's wrong in keep database on cloud? As long as you are using strong password along with key file, there is remote chance that someone would be able to break-in your database.

Re:KeePass

[Prosthetic_Lips]

... and I love the password generation capability. Especially options like "exclude lookalike characters" for when I have to look up the password on my phone.

Re:Keepass

[jon3k]

Apparently the new version will even allow you to synchronize multiple users (just found it earlier in this thread): http://keepass.info/help/base/multiuser.html

With KeePass 2.x, a database can be stored on a shared network drive and used by multiple users. When attempting to save, KeePass first checks whether the file on disk has been modified since it was loaded. If yes, KeePass asks whether to synchronize or overwrite the file (see image on the right). By synchronizing, changes made by other users (file on disk) and changes made by the current user are merged. After the synchronization process has finished, the current user also sees the changes made by others (i.e. the data in the current KeePass instance is up-to-date). If there is a conflict (multiple users edited the same entry), KeePass uses the latest version of the entry based on the last modification time.

KeePass

[DiSKiLLeR]

KeePass?

Works on Windows, Linux, OSX, iPhone, Android, and more.

You can even store the password database on the cloud if you wanted...

Why are you even considering this?

[NemoinSpace]

Go to your desk drawer. Inside there will be 3 numbered envelopes...

Re:Why are you even considering this?

[Anonymous Coward]

Is one an offer letter for you from my firm? because it's been recinded...

KeePass

[st0nerhat]

KeePass satisfies all of your criteria:

• Open Source: It uses an OSI-certified license.
• Multi-user: You can throw the database on a Samba, NFS, etc. share and it will merge changes between different users that have the DB open at the same time.
• Secure: Supports multi-factor authentication.
• Linux-based: Works with Mono.

Password database

[Anonymous Coward]

Keypass nice encryption multiple password inputs and key to text encrypted has keys which can be stored offline. It will do and is free but as it good. I have not done any penetration testing against the db or the keys but as you know anything can be broken given time or a good graphics card :)

keepass?

[Anonymous Coward]

I've always found keepass to work well. it's open source and it integrates with remote desktop manager too if you need it.

GPG + Dropbox

[dw]

At work, we use gpg to encrypt our password file for specific recipients, and place that file in a dropbox share. On occasion, we'll generate a snippet of the file and encrypt it for a specific user (junior admin) and place it in the same location.

Arbitrary complexity is often contrary to trustable security. If you really trust your encryption scheme, then it shouldn't matter where you store it (windows share).

Re:GPG + Dropbox

[Anonymous Coward]

Pretty much do the same but in a git repo instead. When someone leaves their access gets removed and passwds changed. Their is a gpg plugin for vim that makes reading/writing easy too.

Re:GPG + Dropbox

[WuphonsReach]

We create separate files by service and encrypt the contents with GPG (regular old text files with ASCII armored encryption blocks).

Dead simple, other then the GPG key management and passing around public keys. There's also the issue that every time you add someone new, you need to re-encrypt all the files (but that's a key management / PKI issue).

Since they're regular text files, they can be emailed, printed, faxed, OCRd, stuffed in envelopes / safes, etc. We stuff ours into a version control system for simplicity.

It's also a good method to use for personal accounts. Create 1 file per account / service and just encrypt the contents with GPG.

PM me ...

[Anonymous Coward]

all your passwords and I'll keep them safe for you. Just email me when you need them and I'll get them right out to you! I might need to share a few with some third parties and my buddy who goes by BOFH

pwsafe

[Anonymous Coward]

I'm using the pwsafe command line program with a single master password shared among my team.

Re:pwsafe

[Anonymous Coward]

all the places I've worked have used pwsafe.

Just post them here

[Anonymous Coward]

We'll take care of it for you.

Re:Just post them here

[Noughmad]

But how? All we will see is a bunch of stars...

Of course,

[iplayfast]

You can use notepad...

Not free, not open source, not linux based

[Anonymous Coward]

While it's not linux based, or open source, or free, we use Passwordstate (http://www.clickstudios.com.au/) and it's wonderful. It's got a ton of features including auditing and an emergency access password in case you're down completely and need to unlock passwords to restart your systems. I highly recommend it.

Use KeePass

[Anonymous Coward]

My colleagues and I had the same problem at work. We used a spreadsheet and stored it in an access restricted file share. We switched to KeePass and keep the password database file in our IT file share. It's worked out better since it lets you keep notes and metadata with the password entry and has a great password generator. We only have to remember a master password and we can get in to see all of our passwords for our infrastructure.

It's free and cross platform (win, mac, linux).

Password Safe

[matt-fu]

Out of all of the stuff I've tried for team password management, my favorite is Password Safe. I haven't tried the Linux port but apparently there are a couple: http://passwordsafe.sourceforge.net/relatedprojects.shtml The ONLY reason it beats a GPG encrypted password file is ease of use. Ideally you are hiring people who can deal with GPG but my experience is that it can be a decent learning curve just to get people to not use notepad.

Re:Password Safe

[Anonymous Coward]

+1 vote just because it's what Bruce Schneier recommends.

Re:Password Safe

[Anonymous Coward]

+1 for Password Safe.
I have been using it for more than 5 yrs.

I have not tried the Android client yet, but I like the lack of synchronization. I would rather move/copy the file manually than to worry about some security bug.

Re:Password Safe

[lewko]

No real surprise. He recommends it because he designed it.

Re:Password Safe

[Anonymous Coward]

The Linux client cant open a database stored on a network drive. The Windows and OSX client can.

Re:Password Safe

[quintus_horatius]

We use Password Safe in Windows and pwsafe in Linux - they can access the same file if it's on a cifs share.

Re:Password Safe

[Anonymous Coward]

Agree. There is also am iOS app now with Dropbox integration that makes this easy for me. You could even use Dropbox with shared folders for your team

Re:Password Safe

[neonsignal]

Of the Linux versions

1) mypasswordsafe is no longer maintained

2) password gorilla is not particularly fast

3) pwsafe is still in beta

Having said that, they all seem to work fine with no major issues. The last one is the most similar to the current Windows version.

Re:Password Safe

[Rheingold]

We use the command-line implementation http://sourceforge.net/projects/pwsafe integrated revision control. It has a 2-way merge feature, which makes it mostly usable with revision control, even though it's a little more tedious than necessary, since you have to manually accept or reject individual changes. For a while I've wanted to implement 3-way merge so that most merges can be automatic but I will probably never get around to doing so.

The downside of the CLI pwsafe is that it supports only v2 PasswordSafe databases which fortunately works with most other interfaces but lacks some features. The other downside (especially in comparison with a GPG-encrypted file) is the lack of an agent, which regrettably means that very often terminal access is done by 'pwsafe --exportdb | less'.

There is also at least one Android app that can read the database file format: https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe

This is the best solution that I've found.

Phpchain

[Anonymous Coward]

We use phpchain at work. A few hundred accounts for various servers, devices, vendor support accounts, and logins for accounts at companies we work with. All stored securely. Google it if you arent familiar with it. It has been a huge win for us, and does everything asked for. We even wrote a simple search functionality for at that I think has. Een rolled into mainlIne at this point.

Re:Phpchain

[VortexCortex]

We use phpchain at work. A few hundred accounts for various servers, devices, vendor support accounts, and logins for accounts at companies we work with. All stored securely. Google it if you arent familiar with it. It has been a huge win for us, and does everything asked for. We even wrote a simple search functionality for at that I think has. Een rolled into mainlIne at this point.

NEAT! Thanks for the contribution! To repay the favor, I offer you my services. if someone accidentally deletes your passwords, just email me and I'll forward you a copy.

> PHP
> Secure

Choose one.

Re:Phpchain

[dave420]

You can make very secure apps in PHP. You not knowing how to does not mean it's impossible.

WebPasswordSafe

[Anonymous Coward]

http://www.webpasswordsafe.net is open source and multi-platform... "Web-based, multi-user, secure password safe/manager with delegated access controls"

Re:WebPasswordSafe

[Anonymous Coward]

So this can be deployed to a company's intranet. Interesting comparison with other solutions http://webpasswordsafe.blogspot.com/2011/03/webpasswordsafe-vs.html

TiddlyWiki with TiddlerEncryptionPlugin

[lyallp]

http://tiddlywiki.com/ http://remotely-helpful.com/TiddlyWiki/TiddlerEncryptionPlugin.html The tiddlywiki is a wiki that runs in a single html file using javascript where each 'page' is called a 'tiddler' The encryption plugin allows you to apply a password to an individual tiddler or group of tiddlers. You can make the tiddlywiki public, they can see all the unencrypted tiddlers but only read the ones for which you have supplied the passwords.

KeePassX

[Anonymous Coward]

KeePassx - widely available and has a nice auto fill feature in the Linux version.

W3pw

[Anonymous Coward]

We use w3pw. It's outdated and it throws some warnings with the latest versions of PHP. We had an in-house php knowledgeable guy who fixed the 4 lines of code that threw warnings. I wrapped the w3pw program inside an LDAP Auth statement on apache so you have to have valid LDAP credentials (like require-group it-admins etc) and then the shared password for the w3pw program. the mysql db is encrypted and the implementation is sound. You cannot change the master password after setting it because it is the encryption key. That's why I put it behind LDAP auth.

This is definitely an "itch"...

[mlts]

There isn't really anything open source that I know of that is good at multi-user password management. I've seen enterprise appliances that offer this, but those are upwards of $10,000 for a glorified 1U rack PC with locking bolts.

The best way I'd go about this is have the two top security guys in the firm build a Linux or BSD box with whole disk encryption that is locked away somewhere.

As an alternative to Linux, one could use Windows and BitLocker, then VMWare Server or Workstation. This provides protection from physical attack, although nothing is 100%.

This box would have multiple VMs on it for isolation.

One VM would have a RDBMS which can encrypt tables/rows/columns that can be backed up somehow, with the keys obviously stored well away. This would allow for database backups without compromising the stored passwords.

The second one would have the backend web application and Web server, each running in different security contexts, so an Apache compromise won't get much.

As for authentication, that exercise is left to the reader. Username and password over SSL is the minimum.

Re:This is definitely an "itch"...

[hawkinspeter]

I think you're over complicating things and you haven't considered what happens in a disaster scenario when you need to access the passwords, but don't have access to your usual hardware.

KeePass with the file stored in a DropBox folder would be a lot easier.

Re:This is definitely an "itch"...

[Hognoxious]

The best way I'd go about this is have the two top security guys in the firm build a Linux or BSD box with whole disk encryption that is locked away somewhere.

And then don't switch it on, ever.

The most secure I've found

[blake1]

Neither of these are open-source or linux-based, but... Cyber-Ark is the most secure solution I've come across - multi-factor authentication, as well as presenting passwords through a portal rather than granting access to the password file itself. Citrix had a similar solution, Citrix Password Manager, but I believe it is now EOL. For it to provide any real level of security the database needs to be abstracted from the users, otherwise it can easily copied offline and brute forced. "Use a secure password" you say? Of course, but where do you record this 128-bit randomised password?

Re:The most secure I've found

[Anonymous Coward]

Second on Cyber-Ark, it's not perfect but it's the best I've seen.

Re:The most secure I've found

[Anonymous Coward]

I agree, this isn't an Open Source field. You REALLY need that encrypted central database, and a portal.

Some other vendors to consider are Lieberman Software or FoxT, or for AD/Windows centric worlds, Centrify

VIM+OpenSSL

[Anonymous Coward]

http://www.vim.org/scripts/script.php?script_id=2012

Unlike and better than the majority of the password-saferizers out
there, this keeps your passwords in a file which is both decryptable
with standardized tools and in a human readable format (assuming
you typed human readable usernames/passwords in the first place!)

Ten years from now you'll still be able to decrypt your files, and you
can share them with people who don't have the editor plugin.

Re:VIM+OpenSSL

[Anonymous Coward]

No need to involve OpenSSL since VIM 7.3. Use:

echo "set cryptmethod=blowfish" >> .vimrc
vim -X password_file

Done.

Afterwards you open/close it normally like any other file (vim password_file), and, unlike the OpenSSL plugin, you don't need to provide a passphrase again twice when exiting a changed file.

It's semi-multi-user. If someone already has a copy open, it will give you the usual warnings about the .swp file, but will let you open it read-only. In fact, it's prudent to always open it read-only (make an alias) by default anyway.

Re:VIM+OpenSSL

[Anonymous Coward]

Sorry:

vim -x password_file

It is :X, however, if you already have a file open and want to write it out encrypted. Make sure, you're using blowfish (default is insecure).

Not the author here...

[jjoelc]

I'm not the author, but am also watching this thread for answers...

I'd love to find something truly multi-user... Multi user in the sense that not every user would have access to all of the passwords stored in the database. Where I could set up groups and which passwords were available to a user would depend on the group they were a part of. For example, I might not mind all employees being able to look up the keys for the wireless network, but only those in the IT department having access to the admin logins for the wireless router... There are many many other examples, but hopefully you understand the gist...

Any suggestions?

Re:Not the author here...

[Anonymous Coward]

http://code.google.com/p/webpasswordsafe/

Re:Not the author here...

[Anonymous Coward]

Gee, if only there were such thing as a multi-user database...

Just enter the passwords into a database and oh hell why do I bother -- you're not going to listen because your eyes glossed over when I said database.

Re:Not the author here...

[Anonymous Coward]

If your environment is small enough, you can use (with very little restriction) ManageEngine's PasswordManagerPro. I have the free version installed on Linux (CentOS 5.5) and Windows (Server 2003) and it works fine. The only issue is that the free version has a 2-admin-user-limit and a 10-resource-limit. (and I can't/won't tell you how to get around these limits.)

The main thing I can stress about using a password vault, any password vault, is to make sure your backups and backup/restore procedures work.

Re:Not the author here...

[Anonymous Coward]

Setup LDAP authentication if possible. You can setup your wireless to check the users access via LDAP with 802.x if I recall correctly (may use another option).

You can also setup a simple php site that stores the passwords in a MySQL database (or msqlite.. Whatever) for the sites/devices you cant link to the LDAP.server. PHP is able to access and check LDAP accounts, so you'd be getting close to a 1 login coverage for each employee

Re:Not the author here...

[Hatta]

I'd love to find something truly multi-user... Multi user in the sense that not every user would have access to all of the passwords stored in the database.

Why should more than one user ever be able to access a password? One user, one account, one password, never disclosed to anyone under any circumstances whatsoever. If you need multiple users, that's what multiple user accounts and permissions are for. Anything else is just begging for trouble.

Re:Not the author here...

[Prosthetic_Lips]

Standard machine builds with an Admin / root password? When the machine flakes out and cannot connect to a domain controller, you need a local account.

Databases with "sa" account? There are some things that the database will not let an "admin" do, only the DB owner.

Re:Not the author here...

[Hatta]

1) That's what sudo is for.
2) That sounds like a database with a broken permissions system.

Re:Not the author here...

[danbeck]

Look, it must be all black and white there being the printer admin of your 5 man real estate office, but out in the real world, it never, NEVER works like that.

A short list of the billion reasons why you would need what the OP is asking for:
Web services that require a single primary administrative/billing account
Company twitter accounts and other social media accounts
Networking equipment that only allows multi-user auth through RADIUS
admin/root passwords for: databases, servers
common mail accounts shared by multiple users
common account of any random type used by more than one person that doesn't allow multi-user access
Non-enterprise wireless access points
Proprietary commercial software that requires a primary admin account
Random bits of secure information that aren't necessarily a password, but need to be accessed by multiple users

See, when you have to worry about more than out of toner messages on your HP Laserjet II, or our 5 XP laptops you connected to that AD controller, it's not all cut and dry.

Re:Not the author here...

[danbeck]

Awesome, you have it all figured out! We can just go ahead and close this Ask Slashdot then since Hatta has our answer.

Re:Not the author here...

[KookyMan]

I think one way you could make KeePass multiuser is the following setup. Keepass itself isn't, but by utilizing the existing groups of AD/*nix I think you could actually have an efficient way of doing this.

Create Keepass (v2.x) databases, one per group that you have. All the databases can share a common password if you want (won't affect security). When you create them, ensure all have a keyfile as well as a password. I would suggest naming them something like : Database-General, Keyfile-General; Database-Local Admins, Keyfile-Local Admins; Databasse-Group C, Keyfile-Group C. Distribute the common password to those individuals who need access to the shared passwords.

Simply set the read permissions on the various key files to the respective groups that these individuals should be a member of. (Alternative would be just set the read permissions on the databases as well, but if you have local keyfiles you can post the databases to a intranet website, while spreading the access key files around the file system into default drives/directories.

This means you will have multiple databases, but it shouldn't be unmanageable unless you use uber-fine granularity (3 people need one password, but are three different groups and nobody else needs that password.)

One benefit to keepass as well is in certain situations you can create a config file that will over-ride user preferences. Read the help file, I've never had a need to configure it but I think with AD policy you could make use of it.

Re:Not the author here...

[Anonymous Coward]

Not open source, but in case it's useful to anyone reading...

There are a few commercial tools which do this sort of thing, cause it's a fairly common problem within enterprises. I believe many of them support personal passwords within the same system, with all the standard benefits (secure, multi-user, delegated, logged, etc.). I'll link one: http://www.liebsoft.com/Enterprise_Random_Password_Manager/ (which, for disclosure, I'm associated with), but there are several others. Just for reference.

Re:Not the author here...

[Dynedain]

You already have user access groups setup on the filesystem level. If you need different people to have different access to the password database, then split it into multiple databases, and take advantage of your existing filesystem (and hopefully domain) permission structure.

corporate vault

[Anonymous Coward]

You can look at Corporate Vault - http://sourceforge.net/projects/corporatevault/

It's web based and you can create various groups with different level of access

Why are you Anonymous?

[G3ckoG33k]

Are you searching for bugs to exploit?

SFLvault

[anarcat]

I have been keeping an eye on this project for a while. To quote their description: "SFLvault is a Networked credentials store and authentication manager. It has a client/vault (server) architecture allowing to cryptographically store and organise loads of passwords for different machines and services."

The design seems sound, and it is a server/client model which seem to fit well your "multi-user" requirement, which isn't fulfilled by any other password manager that I know of. It can also automagically log you into different services like SSH, MySQL or sudo and can do multi-hop.

The only issue I have found so far is that installing the server component is a bit of a pain (ie. no Debian package, as opposed to the client side)... but i guess this really depends on the "Linux" environment you are using...

I have been maintaining a list of FLOSS password managers in our public wiki for a while, any suggestions not mentionned there are welcome.

Re:SFLvault

[wackysalut]

Hi,

I've read on your wiki the SFLvault section. Actually, SFLvault-server uses SQLAlchemy, so can use MSSQL/MySQL/PostgreSQL/Oracle/SQLite, etc... It's just easier to deploy with SQLite :) Other things to note, is that it is scriptable in Python... we also recently updated the Debian packages, and Simon Piette packaged an .rpm for Fedora (for the client). The server is better installed in a python virtualenv, so the versions don't conflict with system-wide python libs.

We've also ported the server to Pyramid (it was initially Pylons), wrote a bunch of tests, and wrote some documentation to be published on Readthedocs.org.

Any help is welcome :)

(disclaimer: I'm the author, sorry for the shameless plug, thanks for the reference :)

Multi-user?

[anarcat]

Is it multi-user however?

Re:Multi-user?

[Electricity Likes Me]

KeePass 2 can be run on Mono and is multi-user for the databases - you all need the same password to decrypt the database however, but it does allow simultaneous shared access.

Re:Multi-user?

[Anonymous Coward]

I've not had a lot of luck with KeePass 2 on OSX. It crashes a lot. KeePassX works ok though.

Re:Multi-user?

[Kalidor]

This! KeePass2 on a shared drive is how my team does it. A shared database with generic passwords and shared resources, and some of use keep our own DB's with our more accountable user id's. Because it's got the tabbed feature it's super easy to have both databases available, and with the advanced features available when you dig a little bit deeper into the entries, it's really versatile.

As the previous poster mentioned it can be run on Mono, and works quite well actually. It also has readers for most cellphone OS's so syncing it to our phones is an option. Being able to access our DB even at a colleague's desk, or when ssh'ing in from my phone has proven to be a real convenience at times.

I don't think I've seen them claim military grade encryption anywhere, but it's pretty strong. The system also allows you to increases the encryption rounds to suit your taste and tolerance. Much of this hardening however is only partially supported in the 1.x flavours of KeePass.

Re:Multi-user?

[Anonymous Coward]

And webscale. It has to be webscale.

Re:Multi-user?

[Anonymous Coward]

This! KeePass2 on a shared drive

You can go one better than a shared network drive by saving to a URL.
Specifically, setup a subversion server with WebDAV enabled. This way you can always go back to an old version if your db gets corrupted in any way. Subversion hook scripts can be used for implementing a backup plan (we use one to sync our keepass svn repo to a read-only mirror on a remote site.) The apache ldap auth module can be used to control access (this is on top of the actual keepass db password)

Re:Multi-user?

[Anonymous Coward]

KeepassX actually just came out with the KeepassX 2.0 alpha release. That can support the Keepass2 type file. I don't know how long before its stable. And I don't know for sure if its EXACTLY like Keepass 2. But if it is, it should be a great way to do it.

Re:Multi-user?

[Prosthetic_Lips]

I use KeePass personally. It has the capability to open multiple databases of passwords, each with their own passwords. I put my wife's logins into one, and mine into the other one.

I thought about how to use it at work (other than just putting my work ones into my personal database), and the synchronization is pretty awesome. You keep a local copy, and periodically you can sync it (it even remembers recent DBs you have sync'd with), so the shared one is still updateable. I'd suggest that over the multi-user model, only because then you have a local copy if the network goes down. Someone else suggested rotating the passwords; you can open the database and change the master password, and it re-encrypts with that one. You won't be able to sync with older DBs at that point, so you'd want to do it after you were sure everyone had their changes in (sort of like a lenient version control system).

As a previous poster noted, it even has ports for some smartphones. I copy my DB to my phone periodically; all of my userids and passwords are available from my phone (after typing the master password, of course).

My biggest draw for using it personally was the Firefox integration. It detects the form, and stores the userid/password in a format that can be auto-typed for you. No worry about keyloggers! If it doesn't detect the form (some weird, non-form-based sites, like AT&T), you still have the option to copy the userid or password to the clipboard with a menu click, so you are not just using your eyeballs to copy-and-paste (and worry about a keylogger).

It doesn't do the integration on my phone (not running Firefox there), but once you "open" a site, you have notification options for "copy userid to clipboard" or "copy password to clipboard". And, the Android version clears the clipboard and locks the database after a minute (configurable) automatically.

Re:Multi-user?

[aztracker1]

I'd also have the no-install portable executable for windows there... I use this with dropbox for my own passwords...

Re:Multi-user?

[Anonymous Coward]

If you're at all worried about key loggers then you should be equally worried about clipboard sniffers. The clipboard is just as system-wide as the keyboard and it's really easy to tell what program is in the foreground (KeePass) when something new gets copied to the clipboard.

Re:Multi-user?

[Dynedain]

KeePass2 is Windows-only (unless you really want to deal with Mono). The original version is now forked and maintained as KeePassX with OSX and Linux builds available, along with the source.

Really?

[Anonymous Coward]

Really? Just searching online for the submission's title brings up results and reviews. If you go past the first page of Google's search results you get even more good (even better?) hits.

Password Safe

[Anonymous Coward]

Password Safe. Works for multiple users from a CIFS share.

Single point of failure

[Anonymous Coward]

Whatever you use, you will have to acknowledge that a single point of failure makes any secure password management system dangerous. At least, an excel file or notepad will add an attack vector to the host. You need to set up a reliable encryption scheme between each user and the host. You should write down your requirements more precisely. I am going to assume each user has access to different set of passwords.

Firstly, each user will have a key/password and will have access to the resources.
Secondly, the files on the host system SHOULD be encrypted, and sent encrypted to the final destination.
Thirdly, you will have to figure out how to get users to decrypt them, and moreover, you should teach them safe practices as deleting the files securely when they shutdown or leave their computers without surveillance AND keeping the decryption key somewhere safe (with them on a USB stick for instance).
Fourthly, the file in itself should be in a easy format to manager/look up, excel kind of sucks, I used it for 6 months with more than 200 servers and clients, it was OK but a pain in the ass, especially when reinstalling hosts, changing IPs and passwords.

It is trivial to achieve this, but it requires putting many pieces together, if you outsource this and want to find a single application, you may bring up potential vectors, and you will lose control over this system. You need to /trust/ the writers of the application to not make any mistake and be trustworthy.
Depending on the environment you are working in, this may or not be acceptable. Very reliable pieces of software can help you achieve yourself this all-in-one solution and let users view your password file in a secure and convenient way. I think you can get it down in one week, putting pieces together with:

- OpenSSH + public key based authentication
- PGP to encrypt files
- a database as a file (sqlite), or an archive of a repository containing the DB if you need to track down changes
- a python GUI and/or text application to easily dig through the database, it will handle upload and deletion of the file and will not write down anything to disk

There are still risks though:
- Where do people keep their keys (SSH + PGP)? on a stick? then it all boils down to the security of the stick.
- Network failure => not passwords, people might then want to get the DB locally. Leak the PGP key and you're owned (workstations are not assumed to be secure in most places).
Most measures are needed because basic security concepts are not respected, you need to enforce them or the company is doomed. Secure each workstation and educate everyone about basic security. Make them sign an agreement which specify how they handle sensitive data. Then and only then you can distribute the DB locally and not encrypted.

In most places you will find many restrictions and will not be able to implement a very secure system, and above ups will always ignore the worst case scenario. Enforce restrictions and make it usable, the more restrictions you need to enforce, the more you should strive to make your solution all-in-one. But it's not one size fits all, it's a challenge and an everyday work to design, implement and monitor security systems.

Have a look at Clipperz

[Anonymous Coward]

Have a look at Clipperz, more specifically their community edition. Client side encryption in javascript using standard security algorithms that you can also send over SSL if you want.

Keepass for the win!

[AnRkey]

http://keepass.info/

GPG

[Anonymous Coward]

GPG alliws everyone to have their own key, and when you encrypt a file you can encrypt it for everyone on your public key chain. so you could just use that to encrypt the excel file everyone's comfortable with

My Password Manager

[mwdmeyer]

I wrote a web based password manager that might interest you.
It's cheap and you get all the source code on purchase.
http://codecanyon.net/item/password-manager/2145518?ref=michaeldale (includes my referrer link, but you can just delete the ref= part if you wish).

I have a demo version online here: http://www.onlinecompanyportal.com/mrp/
It does categories, multi user, active directory integration and lots more.

Re:My Password Manager

[Anonymous Coward]

I wrote a web based password manager that might interest you.

Yeah, a cloud based password manager is the way to go! Can't beat the security of the cloud.

Re:My Password Manager

[mwdmeyer]

Um did you even check out the link? You host it yourself. Many of my clients simply run it internally on their server with no internet access what so ever. Anonymous Coward indeed.

Single Signon

[Anonymous Coward]

Easier than remembering a million passwords is a good implimentation of single signon so you only need one set of credentials. Software/Appliance manufacturers really need to get behind this idea, and users need to start demanding it.

Truecrypt

[Anonymous Coward]

An office document or text file stored in an encrypted truecrypt file works for me.

Re: Keep It Simple Stupid

[Anonymous Coward]

I use a text file encypted with 2048 bit encryption, save to a gmail account.

My password tool is completely unhackable...

[JetScootr]

It's called pencil and paper. I have a notebook, and all pwds are encoded there. I have 4 simple rules for modifying what I write into what I type in. An example rule you could use is "Real pwds use only even digits; Passwords are written with all ten digits, odd digits are ignored". 2-4 simple rules will make it unhackable even for someone with physical control of passbook. (Never write down the rules - keep them in yer head).
To keep the rules fresh, use different passwords and uids for every single app or website possible. You'll always be rehearsing the rules in yer head, you won't forget them.
Here's an example from my current set: pwd= "RhinoPott=amus" Rule 1,3
I'll bet you can't guess the real password in 10,000 tries. You don't know rules 1 or 3, which modify what's written. Go ahead, give me 10000 tries in a text file - I'll let you know if you get it.
This really really works - I've been doing this way since the 1980's, and haven't misplaced a properly coded pwd yet.

Re:My password tool is completely unhackable...

[pnot]

So how does your system apply to the original question -- sharing the passwords among multiple users? Do you all copy out the relevant parts of each other's notebooks and memorize each other's rules? Or do you tell each other the unencrypted passwords and re-encrypt them individually using personal rule-sets?

Re:My password tool is completely unhackable...

[Cow Jones]

Yes, rules like that are not uncommon. They have their uses in environments where you can't use proper encryption. However, I can see several disadvantages to your method:

For one, the dependency on a single physical storage medium (paper notebook) is a mixed blessing. On the one hand, it denies remote attackers the option to download a complete list of hashes, but on the other hand, it also denies you the possibility of retrieving your passwords when you don't have the notebook with you. Notebooks can also get lost or misplaced, they can be stolen, and they can burn. There's no easy way to make automatic backups of your password list.

More relevant to your particular system is that your rules can be reverse engineered. If someone does have access to the list, they only need a few compromised accounts (or planted passwords) to decypher the rest. If they're lucky, they may get away with a single known password. A rule like "ignore all the odd digits" can easily be cracked when the attacker knows the actual password and your garbled reminder - especially when you write down which rules you applied to it.

All in all, you're better off with a digital format and strong encryption. For passwords which are so sensitive that you can't even trust something like KeePassX (and your OS, and all the drivers on your system, etc etc) - don't write them down anywhere.

I use KeePassX, myself. The database file is in a Subversion repository. But I have to admit that one part of my setup is completely insecure: I periodically print out a full list of passwords, put it in a sealed envelope, and place it in a relative's safe. This way, if something happens to me, they can access (and close, if necessary) all of my accounts.

Re:My password tool is completely unhackable...

[Phroggy]

My company has people in (at least) three different cities who need to access various passwords (and we sometimes work from home, especially when something breaks in the middle of the night). Your solution wouldn't work for us at all.

Re:My password tool is completely unhackable...

[Anonymous Coward]

A pleasure to meet you, Mr. Goldberg. Do you mind if I call you "Rube"?

Re:My password tool is completely unhackable...

[Pascal Sartoretti]

It's called pencil and paper

Unhackable ? If somebody steals it from you, you will experience an original case of denial-of-service... And how do you manage backups (just in case you lost your notebook) ?

If your set of rules are really safe, why not simply write everything in an electronic note ?

Re:My password tool is completely unhackable...

[hansley]

and keep it in a safe..

PS: Re:My password

[JetScootr]

I may be a bit OCD about passwords and security - 30 years USAF and NASA have bent my brain a bit. Typing in pwds a lot doesn't bug me cuz I know my pwd mgt tool is safe because it's out of reach of hackers.

Mortimer

[eadz]

I've checked out and briefly used Mortimer ( https://github.com/aiaio/mortimer ) before and it seems a decent tool.

"mortimer is a password storage application that supports multiple users and basic permissions. The app relies on public key cryptography to facilitate a multi-user password system whose data remains secure even if the database is compromised. Admin users have permission to all password entries on the system. Users may be given permission on a password-group basis."

Re:Mortimer

[Anonymous Coward]

The main problem with Mortimer is that it sorely needs some development. It has been roughly ported to Rails 3 and does have some crashy parts (permissions deletion for example). I tried to patch it but I'm definitely not a rails guy, and some magic code somewhere, related to RJS, breaks my patches when I use (i'm 2ben on github).
Really RoR isn't (yet?) a dependable framework, it uses too much magic things everywhere and is hell to debug unless you're in the development team from the beginning.
If a power RoR coder wants to have a look, please do because for the rest, Mortimer is really great. Patching it is just unfortunately out of my league.

Windows Encrypting File System

[mysidia]

What's "insecure" about an Excel spreadsheet?

If you're already running windows, edit the file > Properties, click advanced "Encrypt" the file on the file server using Windows EFS.

Add the list of authorized users' certificates so only authorized users can decrypt the file.

Make sure to setup an EFS recovery certificate, export that, and back it up somewhere.

Mortimer

[Boltronics]

https://github.com/aiaio/mortimer

The password sharing functionality looks really interesting. I gave it a spin a few months back, but it had an annoying bug at the time (move a password out of a folder to the root level and it can disappear from the UI). I'm guessing a competent Ruby dev with a few spare hours could fork it on GitHub, fix it up and make it work real nice.

More information about it here:
http://www.alexanderinteractive.com/blog/2009/02/mortimer-a-rails-password-manager/
http://www.alexanderinteractive.com/blog/2009/08/mortimer-password-manager-redesigned-v1-2/

Paper!!

[Anonymous Coward]

Just write it down and store it in a filing cabinet. If you need it more than one place, xerox and take it home.

Seriously a little typing won't hurt.

Keypass is a good solution

[Anonymous Coward]

Hi Hello JetScootr, have you even listen about Keypass ?. It is a protected program that can save your passwords on a protected database. For windows, linux or mac take a look for keypass

Teampass and Clipperz

[Anonymous Coward]

I'd recommend TeamPass http://www.teampass.net/ or Clipperz community edition http://www.clipperz.com/open_source/clipperz_community_edition

Gnupg

[ZorkZero]

Open source? Check. Multi-user? Check. Secure? Only as secure as the box it's on, and the boxes that people use to access it, just like everything else. Linux based? Check.

Gnupg and a flat text file.

LastPass might just work here.

[Anonymous Coward]

I know its browser based but http://lastpass.com/ works on Mac, Windows and Linux along with virtually every tablet/phone OS. You can set up multiple users with multi-factor authentication i.e. yubi key, print out grid, etc it's free and your passwords are encrypted before being uploading to the site only you and the people you share the password would know it not lastpass you can also access the passwords if you are disconnected from the net for a time.

Yet another Password Encryption Tool

[thySEus]

try Yapet: http://www.guengel.ch/myapps/yapet/index.shtml

It s running on a Terminal, can thus be easily accessed via ssh.
And it support different password files. The Encryption provided may be
good enough for your needs.

Re:Awesome tool

[Anonymous Coward]

Mod parent up. +5 Hysterical

Web KeePass

[Anonymous Coward]

KeePass is an excellent open source password safe (AES-256 encrypted with ability to customize number of rounds), with a few alternatives to the original version .. one of them is Java based Web service, Web KeePass, that includes ability to share passwords with other people.

The interface itself for Web KeePass is like from the 90s, but otherwise it's pretty decent if you need access to your passwords from online, or need a lot of simultaneous access.

Otherwise, KeePass or KeePassX and several password databases is a good way to go.

Example usage for KeePass:
- For every project/server/zone/whatever that you want to secure separately so only specific people have access to it, create a new password database with a strong random-generated password
- For every group you might want to give access to several password databases secured with strong random-generated passwords, create another password database with the password to the project-specific databases (only if you have a whole lot of them)
- For every user, create a personal password database secured with their own personal password, that would only contain the passwords to the group/project databases they need access to.

Rex6000

[Anonymous Coward]

Well if we're talking about personal passwords, then can I recommend an ancient Rex6000 for that?

http://en.wikipedia.org/wiki/REX_6000

It's offline so can't be hacked, but you need to make some small mods: you open it, cut the PCMCIA lines so it can't be plugged into the dock anymore, then epoxy the case closed so it can't be opened. You then have a passkey protected notepad to store all your passwords in.

These things last 6-12 months on two tiny batteries, everything is stored in flash so no problem changing the batteries. The pin protect feature lets you protect it with an 8 digit number that needs to be entered to unlock it. And it's so slow at entering the code that it's essentially unhackable (about 5 seconds per try, so about 7 years to go through half the code numbers by brute force).

For backup, I photographed it's screen, Truecrypted the JPGs onto a flash key in the company safe. So I have a backup even if it gets stolen.

It's no longer made, but I bet there's a market for these things so perhaps someone will make them again, or something like them.

I have a smartphone and don't trust it with my important data, my Smartphone came with a Facebook app installed on it, so naturally that means I can't trust the phone for privacy and it was no surprise that Facebook ad grabbed all the contact data of every smartphone. Remember Carrier IQ? I can't trust the phone because I don't trust Carrier IQ and as long as phones come with it installed, I cannot be sure it isn't installed on mine.

Brain

[Anonymous Coward]

Brain 2.0. So Open source and of course crossplatform ^-^

free but not open source

[Anonymous Coward]

manageengine password manager. it is a true multiuser password management program. the server can run on windows or linux. does scheduled changes of passwords. can verify the passwords are valid and has reports that shut up auditors!

Excell is as good as Notepad

[Anonymous Coward]

1. Paper based (not printed), locked in a cabinet works when:
  - few people close to each other need access
  - the keys are not accessed often (basically in case of emergency/reinstall/recovery only)
  - key length is an issue (typing a 1 full page of characters is error prone)
2. Shared file
  - works for many people (see locking below)
  - works for people sitting in remove offices or on the other side of the world
  - security is as strong as access policy is:
  * free access to encrypted file means offline brute force attack is possible, security is as strong as the encryption algorithm + key length gives you
  * limited access makes brute forcing of credentials hard, security is as strong as account policy is (user name/password length, number of tries before locking account)
  - many people modifying the file simultaneously raises the issue of locking
  * use 1 file per resource, reduces the collision possibility
  * revision control allows locking
  * editor application locking (everybody should use the same editor, some times needs for cleaning up logs)

So these are your basic possibilities, depending on the amount of people needing access to the keys and where they are. Discussions about some specific software application are basically irrelevant, since encrypting applications are as strong as the PASS PHRASE used to access the keys used for encryption/decryption, meaning that a network drive with strong access and account policy + Notepad is as good as Kerberos/Keypass,GPG or any other encrypting application (ignoring the requirement for file locking).

SHA1_Pass

[_16s]

You may try SHA1_Pass. It runs on Linux, Windows and Macs. It generates passwords based on user input. It does not store passwords. It's open-source and the passwords it generates can be generated with OpenSSL and other Crypto libraries too, so there's no lock-in. http://16s.us/sha1_pass/why/

KeePass

[Anonymous Coward]

KeePass
http://sourceforge.net/projects/keepass/

Good program. easy.

Wrong question

[Jawnn]

If you are not using a more robust access control scheme wherever you can, you are doing it wrong. Yes, there are cases where a single user/pass must be shared, but they are probably few in your organization. For those cases, KeePass is effective, if not particularly elegant. It's certainly more secure than an Excel file.
Do yourself a favor and investigate single sign on (SSO) solutions and work your way toward a tiered access control model.

GPG

[Anonymous Coward]

Assuming you're asking for Linux-based implies a certain level of tech-savvy: Passworded network share with a gpg encoded text file.

GPG

[Tmack]

As many others above have posted, though none got any mod points for (yet)...

Its free, opensource (GNU), widely available as a standard package to most platforms, etc. You create a password file, encrypt with gpg, then sign it with each user's key that should have access to it (requires all users to have proper gpg keys setup). When someone leaves, you revoke their key from the file and they can no longer get to it, without having to do much else. If thats too complicated, just do a basic crypt (gpg -c) and share that password around. Then if someone leaves just decrypt and re-encrypt with a new password.

Re:Awesome tool

[Anonymous Coward]

Clever. I was all ready to send you all my credentials when I noticed you spelled Maryam Abacha's name wrong...

Passpack

[Anonymous Coward]

Passpack is the answer

http://www.passpack.com/

Re:Passpack

[PieterGen]

Basically the same as Lastpass, right?

Old School:

[codermotor]

A lab book stored in a company safe.

Maybe

[PingXao]

Good comment until you said "military grade encryption". There is no such thing and that term is typically used by those who aren't very knowledgable about security. Unfortunately this forces me to discount your opinion on the matter. KeePass2 may very well be a good solution for the problem at hand, but I'm going to need to find some other evidence for that, because whenever someone mentions "military grade encryption" I run away as fast as possible.

Re:Maybe

[Kalidor]

The main reason I mentioned it (but never really got into it) was because of a round up of password storage managers from a few weeks ago that all claimed "military grade" encryption, and all were trivial to compromise. I can't seem to locate the article now but KeePass was not included in this round up specifically cause it didn't try to lump itself into this category.

I've been trying to rack my brain to remeber if there was an alternative suggestion section of the roundups, or if KeePass was mentioned. But since I couldn't find the article, Ieft it in there as a toss away comment. Discount my opinion if you like, I fully realize there is no such thing. There are minimum standards set forth by the NSA and the Military, and differ based on sensitivity and roles, but I really haven't bothered to see if KeePass is up to these standards. Assuming you don't leave the database vulnerable with an easy to guess key phrase, I'm not too concerned about someone managing to access my data from such a database. I'm not that big of a target, and the life of usefulness of such information is relatively short compared to the time it would take to compromise the database. (Assuming proper password complexity rules, aging, and policies are enforced or at least practiced on the information stored)

Password Gorilla

[PieterGen]

Password Gorilla is what I chose - after comparing *lots* of passwordmanagers. I wanted a filemanager that be: - free & open source - offline (--> exit Lastpass) - cross platform (I looked at Linux, OSX, Windows and Android, cause that is what my family uses) - not dependent on Mono (--> exit Keepass). Password Gorilla stores passwords in an encrypted file: the password database. Every user has his own file(s). I have a copy of my file on my smartphone, I synch the files regularly. Read all about it and get it here: https://github.com/zdia/gorilla/wiki/ I like it, it does what I want, but to be honest, the GUI looks a bit simple and the syncing of files (across in my case 2 PC's and a phone) is not automized, although I you could write a script for that. It lacks the slick interface of some other passwordmanagers.

Non electrical means

[LilGuy]

I use a card from http://www.passwordcard.org/

Printed it out, laminated it with tape, and keep it in my wallet which is with me at all times. It's extremely handy and needs no internet access to use.

Keepass

[wiggles]

We use Keepass on a CIFS share. It locks the password file when multiple people have it open so you don't have write problems.

You can also put the file up on a LAMP style website with Web-Keepass.

Try Passwørd Safe

[Anonymous Coward]

http://goryachev.com/password-safe.html

Re:Try Passwørd Safe

[Anonymous Coward]

(I wrote it)

KeePass Almost Ubiquitous

[seawall]

Programs compatible with KeePassX (or ports of KeePassX) exist for pretty much everything: Windows, MacOS, Linux, BSD, Android, iOS but they often have slightly different names (e.g. the program I use on iOS is KyPass) which makes it seem less available than it is.

I wrote my own.

[wezelboy]

Python and m2crypto. I have it coupled with pexpect to do auto login and commands on multiple machines. Saves me a ton of time from having to look in the excel sheet.

Text + Encryption

[Anonymous Coward]

ccrypt passwords.txt
Done.

Personally I recommend a insanly long master password somewhere on paper, in a safe.
And each admin their own password.

passwd mgmt

[Anonymous Coward]

I switched to Clipperz a few years ago and love it.
http://www.clipperz.com/open_source/clipperz_community_edition

Password managers

[Gareth68]

Have gone through nigh on every password manager over past couple of years, KeePass, Lastpass, Passpack, Roboform. All pretty good at giving you access to your passwords. I'm currently using my1login which I quite like for its security and mobility.

TeamPass

[Anonymous Coward]

We just recently tackled the sames question for group password management.

We settled on teampass. http://www.teampass.net/ It satisfied all of our requirements (including integration with AD and logging of who access what when).

Its under active development. Although it appears to be just one individual doing the development.

Secret Server

[MrObi]

It costs and requires Windows + IIS + MSSQL server (Express) but I haven't found any really equivalent at open source side. http://www.thycotic.com/ But then you need only browser to access it. Its perfect for scenario where you have team of admins etc who need to share tons of password with each other.