Password Storage for Company?

Question

I work for a small company of about 15 employees. We don't have an IT guy or system admin.

We have been keeping our passwords stored in an .rtf file on a networked drive, which is not very safe. As it was bound to happen, one of the computers in the network got infected with a trojan horse and the hackers gained access to the file and got on our hosting accounts and started sending out spam. We were notified by the host. I changed all the passwords and deleted the getter files they installed.

My question is: What is the proper way to store passwords safely, in a way in which everyone in the company will have access to them? Maybe a software solution?

Answer 1

You need to store them on a secure database (example: IMB DB2 or PostgreSQL) on a server. Add permissions and create some kind of interface for the users such as an intranet application.

Answer 2

You should not need to store plaintext passwords online. Most computer systems store them in an encrypted hash form so that even if that is stolen, they are hard to crack (assuming they don't yield to a dictionary attack trying "letmein","12345","guest","aardvaark" ...)

Each employee should have their own password and userid, with access control lists giving them access to what they need to to get their job done. When they leave, you drop them off the ACL.

A central authentication server like Kerberos or LDAP or Active Directory means that the hashed passwords are only stored in one place, and that one password allows access to all services at a given security level.



Having said that, there are a number of occasions where devices only have one password, or can't be connected to an authentication server. A paper list in a safe works well. In fact, there are passwords (such as encryption keys and the administrator password to the authentication server) that should be written down and placed in a safe so that if someone is hit by a bus or just forgets, others can access critical information.



I have in fact implemented a password store for that kind of shared password, but it's a bit messy and not ready for general release. Basically, I just use the open-source GPG (like PGP) program to encrypt a list of passwords with the public keys of each of a number of authorized users. Any of them can access the list with their own private key, which they keep to themselves, and if anyone leaves, their public key is just dropped from the list of keys used - there is no master password or key that must be quickly changed, locking everyone out till they can be told the new secret.



(the messy bit is that the list is held in an SVN version control repository, and I try to make sure all the plaintext files are properly erased when someone edits the list)



There are lots of password vault programs, and one built into Firefox, but generally those have one master password that everyone knows. Which is probably fine in a small business where you are more worried about hackers than a dishonest employee or someone being let go under a cloud. (Not that I'm really worried about that, but it was an intellectual exercise to try to do it right)

Answer 3

Jack,



If you are in one physical location, might I suggest a FIPS encrypted flash drive. Keep it in a secure place that everyone has access to. FIPS drives are relatively cheap, and you must have the password to read the encrypted files. We use them at my office for when people have to take client data off-site.

Answer 4

A paper list?



The chances of losing that are low if you keep it in a fireproof secure box/safe