I administrate several Windows servers, and I have run into this "how do I maintain all my passwords" problem.

The servers in question are all stand-alone and distributed all over the world. In other words, they are not connected to a domain and network access to the servers are limited (they are not directly accessible over the internet). I am however able to access all servers from a single gateway server, which have working routes to all these networks.

Currently, I am using the same username and password to access all the servers in addition to using AuthLite (with Yubikeys) as two-factor authentication. However, I would like to change the one-password-fits-all policy by having a separate password on each server. My problem is then how these passwords should be stored centrally.

The simplest way would be to store them in a database (Excel sheets are not an option), but on the other hand, I am not too keen on storing the passwords in plain text. I cannot store them as hashes, because I need to be able to look up what the passwords are whenever I (or someone else) needs them. I'm thinking that a symmetric key password manager like LastPass would be a decent solution, but I need to host this application on a server of my choosing, so that other people are able to access the passwords whenever they are needed.

Can anyone recommend an off the shelf application that might solve my problem, or a method which I could implement myself using a SQL server database and a web based GUI? Ideally, the users who have access to these server passwords should be able to log in to this solution with their own username/password, and then be given access to the passwords I want to protect.

  • is keypass(download it) sufficient?
    – barlop
    May 17 '13 at 9:30
  • As a last resort yes, but I am more interested in a client-server model, where multiple users can access an account/repository where these passwords are stored.
    – v3gard
    May 17 '13 at 9:52
  • @v3gard: In that case the question might be a duplicate of superuser.com/questions/595059/… May 17 '13 at 10:35

There plenty of programs that store password info.

I use Password Safe which has the same features that Simon mentions for KeePass. It can be used with Yubikeys.

You mention LastPass "would be a decent solution, but I need to host this application on a server of my choosing, so that other people are able to access the passwords whenever they are needed", but I don't see why your storage would not work across the Internet.
(What's the risk of your server going down vs. internet access being unavailable? - Well, you have better insight into your server configuration than I do).
Lastpass can be used with Yubikeys. It is very secure, has all the provisions like 'what if LastPass goes bankrupt' etc.
Its security was extensively discussed in Security Now ep. 256 and in the Q&A in later episodes.

  • So "password safe" has the features of keepass, which isn't what he's looking for. Yubikey looks interesting but looks like it means many users buying that hardware -special usb stick thing- I suppose the password is stored encrypted on that. You said "I don't see why your storage would not work across the Internet." I don't understand that question. How are you making your storage accessible over the internet? And he may not need people logging in over the internet.
    – barlop
    May 17 '13 at 19:44

I would recommend KeePass.

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. The databases are encrypted using the best and most secure encryption algorithms currently known (AES and Twofish).

Features that might be interesting for you:

  • KeePass is portable: it can be carried on an USB stick and runs on Windows systems without being installed.
  • A password database consists of only one file that can be transferred from one computer to another easily.
  • KeePass can generate strong random passwords for you.
  • KeePass is a great solution as long as I am the sole administrator of these servers. However, if I need to share that responsibility with someone else, it gets trickier. From my understanding, KeePass does not offer a centralized (server-side) account that multiple users can access? On the other hand, there is always the alternative of transferring the password database file between computers - but I don't see that as a viable long-term solution..
    – v3gard
    May 17 '13 at 9:50
  • -1 You did not read the comment and his reply written one hour before your answer.
    – barlop
    May 17 '13 at 19:36
  • @barlop Thank you for explaining your downvote. If you checked the timestamps, you would have noticed that my answer was posted 12 minutes after the question was asked and 14 minutes before the comment of v3gard.
    – Simon
    May 21 '13 at 7:57
  • @Simon OK, i've removed the downvote, I see that while my pertinent comment on his question predated your answer being posted, his comment in reply came after it. I have removed my downvote. Reason for editing your question to add a space was just to enable removal of the downvote(sometimes the system says your vote is locked until the question is edited)
    – barlop
    May 21 '13 at 9:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.