Ask HN: How do you store Unix passwords for your servers?

Posted by georgerobinson on Sunday August 09, 2015 @07:30AM
from the ask-hn dept.

Happy Sunday!

I have a question for you HN readers about password security (or rather, storing passwords securely!).

I don't use password authentication (disabled in sshd_config) to SSH into my remote hosts. However, that doesn't mean I can simply throw away the password once PKA is set up. I might need to run su to login as root to install software, or to execute other privileged operations.

How do you store said passwords? Do you use a password manager? If so, do you ensure that your password manager is available even when you're away from your machine? Is there a particular software suite that you use, or would recommend?

( 5 comments | 5 points | on HN )

Re:Ask HN: How do you store Unix passwords for your servers? by tptacek on Sunday August 09, 2015 @07:57PM (#10032002)

You're probably overthinking it. Use SSH keys to log in, and if you want to lock things down further than "admin users are simply in sudoers", then write a more complicated sudoers that permits only some commands for some users.

In practice, an attacker who gets a shell on one of your servers has game-over access to the data center the server's in.

[ Parent | on HN ]

Re:Ask HN: How do you store Unix passwords for your servers? by lbostral on Sunday August 09, 2015 @07:42AM (#10030083)

I think that Foxpass answers all your needs https://www.foxpass.com/learn/

[ Parent | on HN ]

Re:Ask HN: How do you store Unix passwords for your servers? by nautical on Sunday August 09, 2015 @03:45PM (#10031301)

Have a general password generation rule for servers and accounts for eg : my/family name + website/server name + current month/year + !@# + some movie name etc ... i tend not to trust any one with passwords .

[ Parent | on HN ]

Re:Ask HN: How do you store Unix passwords for your servers? by wglb on Sunday August 09, 2015 @09:49PM (#10032290)

You might want to think through if that pattern isn't really on the list of the one terabyte of passwords and phrases that a good password cracker might build to filter through his GPU rack.

That is to say, I would venture that passwords by this or any other scheme is too easy to crack. Better have something like 1password generate them for you.

[ Parent | on HN ]

Re:Ask HN: How do you store Unix passwords for your servers? by nautical on Monday August 10, 2015 @06:25PM (#10037851)

I dont completely agree or disagree . There are more factors like my native language being non english and what i type is translated version of language to english and some other factors , I find it more secure thn trusting some one else . Personal preference , although I would love some maths on the top of it , cant talk without numbers .

[ Parent | on HN ]