2

We have fairly large infrastructure to run our services - one of the component for running GUI enabled tests on windows.

There are many places the plain text password is used such as "remote desktop to windows machine" , login to a default account (windows). We now need to change this account every couple of weeks. Is there a solution to manage this effectively?

Needs:

  • Store password in single place, encrypted - we will reset password and only update here
  • Fetch it using a API (say REST api call using token?)
  • Commercial or Free is fine

What complicates the situation is the number of service accounts- we have about 50 service accounts (couple of the accounts are having administrative rights on machines; most are plain accounts), team size is less than 10.

  • What scale are we talking about? You want to manage 50 secrets; how many users do you expect? – Vlastimil Ovčáčík Nov 18 '17 at 8:37
  • @ Vlastimil Ovčáčík - less than 10 - for now – Jayan Nov 18 '17 at 8:44
  • In that case I guess Vault by HashiCorp would be overkill. If you really want API access to the secrets, maybe give it a try anyway. Otherwise I would use some low-tech solution, like encrypted file on network storage. – Vlastimil Ovčáčík Nov 18 '17 at 14:45
2

ccrypt is a simple GPLed command-line encryption tool. You could store the passwords in a text file, encrypt it with ccrypt, and then get the decrypted version remotely by calling ccdecrypt over SSH (or, fetch the encrypted version and then decrypt it locally).

2

Vault open source secret management system. In your scenario it would basically work as online password manager. The value of this solution lies in this imho:

  • you will teach users to use vault to securely fetch current Windows password
    • users don't need to manage this password, as they can always fetch it again
  • you can change the secret without notifying users, because they get up to date credential next time they call vault

I also like that Vault is single binary which makes deployment easy. Go ahead and read their Your First Secret tutorial.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.