Managing website passwords for small team

Question

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is the best practice password policy to use in this situation? The policy needs to accommodate many accounts on other sites (say, more than a dozen), as well as how the passwords are shared among team members (and changed if members leave).

Edit: To response to this.josh's comment, as I mentioned, more than 10 third-party accounts. Most of the accounts are standard password-protected accounts where there must be one for the whole team (these are services associated with the website as a whole, like the Amazon Affiliates program or reCAPTCHA). The services provided vary, few are critical, but they are still important to protect.

Answer 1

I would highly reccomend using a variant of keypass. I use keepassx, it will allow you to keep a local repository of all of your passwords and sensitive information encrypted and accessible to all of your team members.

I have been using keepassx at work for about a year now and have had no complaints.

Answer 2

I suggest Secret Server. Auditing is built in. It will also remember when the password was changed last, and it will remind you when a preset time is up (I.E 30 days) Also you can use roles to choose who has access to certain passwords.

Answer 3

I have to revise my comment. There are solutions for password management and sharing: Passpack for small groups it's cheap (4$ a month).

Unfortunately it doesn't provide auditing and doesn't remember when the password was last set.