Using password keepers (LastPass/Bitwarden etc) for storing admin sensitive info?

Hi, I started using Keepass, personally, and after some time, we were sharing that keepass between 3 or 4 people, and it was ok, but not clean at all.

it was stored in a shared O365 folder, configured to always be able locally, in case of network failure or anything, we all keep a local copy, also I used to manually create a copy weekly to my local laptop.

Also we tested Passbolt, a password manager that could be deploy locally or cloud, has a community version, and you can have different access rights,

groups, users, etc. also has browser integrations.

I didn’t have the chance to implement it in my office, but I’ve tested in my home lab and now changing my personal (and wife’s) keepass to it!

hopefully helps!

Br.

@Cragdoo I was looking into its free plan, which seems to be the only decent one not lacking serious features.

Are you using it though for personal stuff strickly or for organizational info too (say credentials for hosts/services etc)?

I’m more than happy to use it for personal stuff/banks etc. I do hesitate to use it for organizational sensitive info...

I use it for both, personal and business info / accounts.

once in a while I export a copy and put it on my safe box, just in case.

what I have is two setups, one for personal and one for the organisation credentials.

🤪

Sure.

at home, I had a Keepass database for personal use, and then for the company, another different database, stored in a different place.

With the new setup, my passbolt deployment is stored on my homelab (small mini tiny datacenter) and my actual company works with Keepass, and planning to move to something similar to passbolt.

so yes, the idea is to store securely the passwords, but I like keeping separated work and home stuff.

I have separate laptops as well, for work and personal usage.

if you are interested, you can ping me by PM and Inwill be more than happy to help you!

cheers,

@Chris.Childerhose and @HunterLAFR how does the passbolt browser extension work compared to whatever other you were or are using? 

Great advantage for me is that there are “plain” (non-Docker) Linux installs available. And even though I don’t have time to commit for a pilot server deployment, I could help with the central IT of my organization to do something that will help organize our mess.

Summarizing:

1. No one seems to password managers to store company credentials, when the password manager uses its own cloud (internet). OTOH, it seems to be a good practice to use password managers that utilize on-premise clouds.
2. KeePass seems to be widely used (off-topic: last time I had some sort of encryption for local files was with some early PGP versions). For one-man-teams or for very small ones it can do the job, regarding storage of confidential data. I do not know how well it integrates with browsers...

I have used Keypass as it was local, we exported backups. It worked ok.

1Password is the best I find, Can have it on my phone, PC, remote if needed.   It is very secure. You can set up multifactor authentication with hardware tokens and key generation. Unless you have a specific device, plus a physical token, plus a generated key, good luck trying to get in

At some point, you have to trust something, having the same admin password on all your servers is worse than having all your passwords in a password manager.  Someone will do something bad on your network getting a bad actor access before 1password get hacked most likely. Once they are in your NW, they can do lateral movement and gain access pretty quick. At a minimum unique passwords everywhere should slow them down.

1Password can crank your complexity as high as you want, and auto fill everything too which is nice. Install the browser plugins, app, yadda yadda, I sound like a sales guy.  Plus if you convince your work to get it you can get a free personal edition.

I’d look into 1Password as my company is crazy about security and they passed our requirements.  

@Chris.Childerhose thanks for the clarification.

@Scott I’m having a different password per system with a special pass generator (read: I’m banging randomly the keyboard until 20-60 characters are spewed :D).

@Michael Melter “small shops” fits my bill. Specifically the sub organization I’m managing. It’s a 2 person department. However our bigger organization could benefit from a hosted in-premises solution, like bitwarden and passbolt. If I might ask, what is the size of your IT department (approximate order, if you like).

I’ve started using KeePass in the way @HunterLAFR uses it at work (single secret file in an onedrive folder, always locally cached between colleagues), while I’ll keep using Firefox Sync for syncing personal passwords there for a little longer.

KeyPass was decent for us, but with 1Password using vaults with different permissions settings has been a life changer for our IT deparment, Dev’s have their own vault, apps and web guys have their own, desktop team and then the server/storage team have a vault…. 

A small group can change permissions to allow others which alerts and notifies everyone so nothing going on unnoticed, you can share passwords with users or groups of users and not an entire vault.

On prem is the only thing that if you need specifically, 1password isn’t going to do for you.

If you are putting your secret file in OneDrive, you are no longer using an “On Prem” solution 

The versioning and history in 1password is nice too. I can’t tell you how many people changed  multiple passwords in KeyPass and didn’t save.

I use Bitwarden for personal password and other stuffs.

I cannot live without this software anymore 😂