Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I work with two partners/friends and I'm the one who takes care of all the tech stuffs here. I hired consultants, programmers and each of them have parts of the credentials. But turns out I'm the only one with all the passwords (firewall, switches etc).

So, we started talking the big ifs of life yesterday and this thing came out.

The easiest thing is to create an encrypted file and hand it to them from time to time, but I doubt I'll remember to update each change every time.

How do you handle this? I use 1password but is currently mixed with personal stuff and even if dead I would like to keep my private stuff... um.. private

thanks for your ideas!

share|improve this question

marked as duplicate by Brad Patton, slhck Apr 18 '13 at 12:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

The good old 'bus factor'. While there's advantages to allowing a single person to control things, naturally should you be dead or otherwise unavailable, you're a single point of failure.

I'd start by working out who has access to what and creating a master list of that - on the short run, finding someone who has the piece of that puzzle is useful.

Expanding on that, ensuring redundancy is essential - One is as good as none. Having at least one other person who can cover the role of someone who is unavailable means you don't have a bottleneck should anything happen. You don't need to duplicate complete control, just work out someone who needs/can be trusted with that level of access.

"The easiest thing is to create an encrypted file and hand it to them from time to time, but I doubt I'll remember to update each change every time" - Rather than doing so, create/add the necessary access to the individual's account as needed, and revoke as needed. Keep a master database or excel spreadsheet to track this. Memory sucks - get a process to handle this, and make sure your backup person (you do have one) or people know how this works. Where possible Role Based Access Control, or RBAC might be useful here - add someone to a group as needed, and drop em from it once they are done. Never ever ever share credentials. Give the person's account the permissions they need instead. Ideally this would be a single unified account (like something in AD), but not necessarily so - you could give admin rights (perhaps using sudoers) to two people who administer seperate servers to each others servers, but using a specific individual accounts.

Keep work and personal stuff separate (naturally!). You shouldn't be using office/work e mail for personal stuff anyway, and likewise, using personal e mail and other resources for work just messes things up. Even in a family firm, I keep my own e mail address separate from the one I use on official business. Makes it easier to search for stuff since I know which e mail account to look in. Having a separate account for stuff you want to be accessible should you get hit by a bus, and forwarding stuff there is another option.

This also means for a last-gasp solution (pun entirely intended!), you can have a master password for resources - say a separate lastpass key, paper with the password or an encrypted folder with a keyfile - you have the option of writing it down, or locking a USB with the decryption keys inside a safe. Have the device or paper in a tamper-evident container, and check and change the password at a fixed interval.

share|improve this answer
On my very first sysadmin job (as a student) the secretary to the director of the department and somebody else (I forget who it was) both kept a sealed envelope with the passwords under lock in their offices. The passwords (and envelopes) were renewed periodically, and their integrity checked daily. – vonbrand Apr 18 '13 at 12:05

We use lastpass enterprise (but any pw management system will work) and maintain a shared folder with the critical "keys to the kingdom". Those entrusted with keeping the business going in my absence have access to that folder.

I maintain all my other work-related passwords in a non-shared folder

Personal credentials are kept in a personal lastpass account which is separate, but can be linked to my work account for easy access.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.