How do most teams handle the storage of passwords, in particular the required changes when team members leave ?

Right now, we use a centrally stored encrypted file but the thought of changing 100's of passwords when key employees leave is a bit overwhelming.

  • +1 for a question not just about where to store credentials, but how to push them out Apr 13, 2013 at 3:49

3 Answers 3


We use a truecrypt vault with our shared/hardcoded passwords. Some of the team keep an encrypted copy of the file on their phone.

We use AD to push out local Administrator passwords to our Windows servers.

We use puppet to change the local root passwords and remove ex employee ssh keys from our Linux servers.

We use Kiwi Cat tools to manage our Cisco hardware, and use it to reset passwords.

That still leaves less than a dozen "one-off" devices (UPS's, remote PDU's, printers, etc) that we manually update.

We change passwords every 6 months, or immediately when we lose a team member.


One method I've seen used at larger companies is products like Cyber-Ark that essentially take control of the passwords for the boxes and then have a set-up where you can request a password for a specific host for a time period. The application then gives you the password and changes it after the time period is up. An additional advantage to this approach is that you have a log of who had access to the server and when.

That way when a team member leaves they won't actually know any of the passwords. Obviously you need to combine this with monitoring tools to stop people adding unauthorised accounts or back-doors but if you've got enough accounts to manage it can be a good approach.


At my department, identity and access control is centralized in IPA, which allows to:

  • very easily add/remove accounts based on RBAC profiles
  • define the status of the accounts (enabled/disabled)
  • store the ssh key(s) of the users (so no keys exist in the servers)
  • define password policies
  • very easily implement multifactor authentication (kerberos + RSA + password)
  • several other account and control features not directly related to your question (sudo, HBAC, SELinux, certificate handling, ...)

When a team member leaves, his/her account is disabled in a first step, and removed afterwards, through the proper management workflows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.