Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Problem

I work in an environment where I have to use my LDAP ID+pass for running various applications as admin, sending emails, or for letting the application access the internet and so on..

A short list of the apps and where my password lies in them :

  1. SONAR - in the config file
  2. Nexus - entered in the application (get encrypted in the config file)
  3. SVN - a cleartext in a properties file
  4. JIRA - secured in the user database
  5. Jenkins - entered in the application UI - my SVN password - masked , my Jenkins password - secure, my JIRA password - masked , my Nexus admin password - encrypted and maybe a few others might be added.

Now my password is visible to your average inquisitive user via configuration files, in some unprotected logs, or just plain in sight in the application UI. So I have 3 problems A. My personal password privacy B. Users having indirect access to the common master/admin password for many apps. C. Scope of my password getting locked by repeated attempts etc.

Current Scenario

Currently I get by, by working this problem at the level of each application- encrypting/masking the password or restricting access or some other recommended means.

What I am looking for

Panacea. Am I missing something somewhere by doing it per application and making it complex ? Is there a solution available somewhere for this I am not aware of. What is the correct approach to this problem I think would be pretty common ??



  1. There is no SSO
  2. Mix AIX+Windows environment using LDAP, AD (and maybe oauth, I am not sure)
  3. The organization does not allow for a dummy/user-independent ID to be created which will take care of problem A.
share|improve this question
    
I'm not sure I understand the issue. Wouldn't something like Avast! EasyPass do the job? Or that thing I heard of, the name of which I forgot, which is a portable app that you can put on an USB key to actually use as a physical key that stores, very securely, passwords, and manages them for you. –  Ariane Jan 7 '13 at 8:38
    
@Ariane I check the website and I don't think EasyPass will take care of this. USB devices not allowed as its an FS company. Updated the question. –  Pulak Agrawal Jan 7 '13 at 9:16
    
I still don't quite understand the question, so I'll leave it for others to answer, but just in case, look in there if there's software that looks like it would be appropriate for you. alternativeto.net/software/avast-easypass –  Ariane Jan 7 '13 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.