Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do most teams handle the storage of passwords, in particular the required changes when team members leave ?

Right now, we use a centrally stored encrypted file but the thought of changing 100's of passwords when key employees leave is a bit overwhelming.

share|improve this question
+1 for a question not just about where to store credentials, but how to push them out – BrianAdkins Apr 13 '13 at 3:49
up vote 7 down vote accepted

We use a truecrypt vault with our shared/hardcoded passwords. Some of the team keep an encrypted copy of the file on their phone.

We use AD to push out local Administrator passwords to our Windows servers.

We use puppet to change the local root passwords and remove ex employee ssh keys from our Linux servers.

We use Kiwi Cat tools to manage our Cisco hardware, and use it to reset passwords.

That still leaves less than a dozen "one-off" devices (UPS's, remote PDU's, printers, etc) that we manually update.

We change passwords every 6 months, or immediately when we lose a team member.

share|improve this answer

One method I've seen used at larger companies is products like Cyber-Ark that essentially take control of the passwords for the boxes and then have a set-up where you can request a password for a specific host for a time period. The application then gives you the password and changes it after the time period is up. An additional advantage to this approach is that you have a log of who had access to the server and when.

That way when a team member leaves they won't actually know any of the passwords. Obviously you need to combine this with monitoring tools to stop people adding unauthorised accounts or back-doors but if you've got enough accounts to manage it can be a good approach.

share|improve this answer

At my department, identity and access control is centralized in IPA, which allows to:

  • very easily add/remove accounts based on RBAC profiles
  • define the status of the accounts (enabled/disabled)
  • store the ssh key(s) of the users (so no keys exist in the servers)
  • define password policies
  • very easily implement multifactor authentication (kerberos + RSA + password)
  • several other account and control features not directly related to your question (sudo, HBAC, SELinux, certificate handling, ...)

When a team member leaves, his/her account is disabled in a first step, and removed afterwards, through the proper management workflows.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.