How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
6
-
5Tons of ways, most of them crappy. The only good strategy is to use a password manager that supports multiple accounts sharing passwords. Do you have a problem you are looking to solve or are you just curious>?– Neil SmithlineMay 30, 2018 at 2:33
-
2"What do you all use?" Is not a good question fit here. "What's commonly used?" Is borderline. Can you expand your question to explain what you are trying to accomplish and, for instance, what you mean by "large companies"? Are you looking for best practices? Tools?– schroeder ♦May 30, 2018 at 7:28
-
3To expand on schroeder's comment: what do you mean by "important"? Root access to a machine that is air-gapped and otherwise isolated may or may not be "important". Login credentials for a company Twitter account are definitely important while my personal Facebook login credentials are probably not. Another hint: narrow your question down instead of trying to get a "fit all"-answer, the answer is probably more interesting.– Tom K.May 30, 2018 at 9:51
-
1Look up things like CyberArk - basically, high end password managers– MatthewMay 30, 2018 at 16:11
-
Thanks for your responses, I have tried to improve the quality of the question and clarify. @NeilSmithline I'm just curious.– VortixDevMay 30, 2018 at 20:06
|
Show 1 more comment
2 Answers
First, root access to a machine does not require to be shared. The number of human beings that need to be administrators should be small before the number of users that the machine can accept. Said differently, each administrator of a machine should have personal credentials for that machine, that should allow him/her to require administrative priviledges. That is the only way to be able to know who is responsable for what in case of trouble. And that comes out of the box for Unix-Linux systems as well as Microsoft ones.
In the opposite it is no harm in having the same credentials allow access to a group of machines. Single Sign On systems can be found everywhere, from the good old Kerberos to Microsoft Active Directory or LDAP. What matters is that the group of machines must be identified. Even inside a datacenter, it is common for administators to share same credentials for all machines of one security zone.
That does not mean that companies pretending to be serious never do security horrors like installing the credentials for a bunch of machines (mainly machines belonging to their clients) in some relay host. Nor does that mean that credentials for the company facebook account is not written on a paperboard in the communication service office, but those are definitely poor security practices.
answered May 30, 2018 at 15:51
In short; most likely (hopefully) some kind of password manager would be used here. As mentioned by Neil Smithline there are tons of ways of actually doing this and most ways are quite awful.
The only "good" method is a password manager of some kind, whether it be KeePass or perhaps an online password manager such as LastPass or DashLane. Realistically it doesn't matter what password manager I give you as an example, ideally, you need to research what would suit your requirements (if you do have a specific problem to solve) these are just examples of what you could use. I am in no way advising you do use them or ill-advising them.
However, as mentioned this is a broad question & it's quite hard to answer as it stands.