5 ms·

Ask HN: How do you store/manage all of the passwords your organization uses?

9 points by awwstn 14y ago

swanson 14y ago
"Very alpha" - but I think this is exactly what you want. https://github.com/github/swordfish https://github.com/github/swordfish
awwstn 14y ago
We've used a few solutions we created for ourselves, and I know LastPass has an enterprise feature, but I'm curious if people have thoughts and advice on tools that worked or didn't work.
win_ini 14y ago
We are looking at lastPass - looks good so far. (enterprise Ed) IronStratus is another one to check out lets users keep their own personal passwords and grant access to apps passwords by an admin. I personally prefer 1password - but it's really single user oriented. Obviously different from I'd/auth providers like okta or ping identity...but i find there are so many accounts/passwords shared in organizations for services that these guys may not support. (apps with no SSO services for example). Yes, they have some password management tools but they don't seem to have in app/browser shortcuts (ie:chrome/ff extensions).
EvanAnderson 14y ago
We have a nice question about this over at Server Fault: http://serverfault.com/questions/119892/company-password-management http://serverfault.com/questions/119892/company-password-man... I've looked at Thycotic Software's Secret Server product (http://www.thycotic.com/products_secretserver_overview.html http://www.thycotic.com/products_secretserver_overview.html) I was impressed, but none of my consulting customers have signed-up. I recently spun up a copy of the open source WebPasswordSafe (http://code.google.com/p/webpasswordsafe/ http://code.google.com/p/webpasswordsafe/) and liked what I saw but haven't really had much of a chance to bang on it. Wearing my security auditing / pentester hat I've run into CyberArk's Enterprise Vault product (http://www.cyber-ark.com/digital-vault-products/pim-suite/enterprise-password-vault/index.asp http://www.cyber-ark.com/digital-vault-products/pim-suite/en...) and found it very reasonable. It was refreshing to do a pentest where we didn't find a shared Keepass database or something similar.
golovast 14y ago
Keepass is a decent option for a smaller company (http://keepass.info/ http://keepass.info/). It's a bit limited in a sense that it doesn't support multiple users that can view different password tiers, but it does an ok job at syncing changes by multiple users. I am sure there are plenty of decent commercial options. I've seen some companies hack a homemade solution based on Truecrypt as well, though it's probably not very efficient.
- gvb 14y ago
  We also use KeePass (Classic Edition) saved in a repository that we can then share. The nice thing about KeePass is that there are clients/ports/compatible programs on Windows, linux, iDevices, and Android. The repository gives us versioning and a relatively crude but effective way of sharing as well as some additional access control.
deleted 14y ago
[deleted]
bkanber 14y ago
We use passpack.com over here, but for server SSH logins we strictly use publickey authentication.
- achompas 14y ago
  Another vote for Passpack. Great service.
devb0x 14y ago
KeyPass all the way. Truecrypt over it for when I back it up somewhere online
DenisM 14y ago
I use www.memengo.com in combination with the iOS app. I also own and operate the site and the app.

9 points by awwstn 14y ago

"Very alpha" - but I think this is exactly what you want. https://github.com/github/swordfish https://github.com/github/swordfish

awwstn 14y ago

We've used a few solutions we created for ourselves, and I know LastPass has an enterprise feature, but I'm curious if people have thoughts and advice on tools that worked or didn't work.

win_ini 14y ago

We are looking at lastPass - looks good so far. (enterprise Ed) IronStratus is another one to check out lets users keep their own personal passwords and grant access to apps passwords by an admin. I personally prefer 1password - but it's really single user oriented. Obviously different from I'd/auth providers like okta or ping identity...but i find there are so many accounts/passwords shared in organizations for services that these guys may not support. (apps with no SSO services for example). Yes, they have some password management tools but they don't seem to have in app/browser shortcuts (ie:chrome/ff extensions).

EvanAnderson 14y ago

We have a nice question about this over at Server Fault: http://serverfault.com/questions/119892/company-password-management http://serverfault.com/questions/119892/company-password-man... I've looked at Thycotic Software's Secret Server product (http://www.thycotic.com/products_secretserver_overview.html http://www.thycotic.com/products_secretserver_overview.html) I was impressed, but none of my consulting customers have signed-up. I recently spun up a copy of the open source WebPasswordSafe (http://code.google.com/p/webpasswordsafe/ http://code.google.com/p/webpasswordsafe/) and liked what I saw but haven't really had much of a chance to bang on it. Wearing my security auditing / pentester hat I've run into CyberArk's Enterprise Vault product (http://www.cyber-ark.com/digital-vault-products/pim-suite/enterprise-password-vault/index.asp http://www.cyber-ark.com/digital-vault-products/pim-suite/en...) and found it very reasonable. It was refreshing to do a pentest where we didn't find a shared Keepass database or something similar.

golovast 14y ago

Keepass is a decent option for a smaller company (http://keepass.info/ http://keepass.info/). It's a bit limited in a sense that it doesn't support multiple users that can view different password tiers, but it does an ok job at syncing changes by multiple users. I am sure there are plenty of decent commercial options. I've seen some companies hack a homemade solution based on Truecrypt as well, though it's probably not very efficient.

gvb 14y ago
We also use KeePass (Classic Edition) saved in a repository that we can then share. The nice thing about KeePass is that there are clients/ports/compatible programs on Windows, linux, iDevices, and Android. The repository gives us versioning and a relatively crude but effective way of sharing as well as some additional access control.

deleted 14y ago

[deleted]

bkanber 14y ago

We use passpack.com over here, but for server SSH logins we strictly use publickey authentication.

achompas 14y ago
Another vote for Passpack. Great service.

devb0x 14y ago

KeyPass all the way. Truecrypt over it for when I back it up somewhere online

DenisM 14y ago

I use www.memengo.com in combination with the iOS app. I also own and operate the site and the app.