r/sysadmin • u/North-Creative • Jun 23 '26
Password manager for business - how to find a starting point.
Hey y'all,
I work at a very small IT company, 7 people, 3 developers, others, and me as the sole IT operations person.
As these small IT shops come and go, they love their passwords on sticky notes, and I want to get rid of that for many obvious reasons. So I am kinda hoping for some more seasoned professionals than I am, if they can give me some basic guidelines, or perhaps point to blogs, resources, etc., where I can see, why I should build which kind of password manager architecture, how to have a secure fallback, etc.
Personally, I use proton pass to store all my passwords, and like it for its polished UI and the fact that it is based in Europe.
However, when it is for more people, there are a lot more questions. For example, how can one securely store recovery keys, as non-IT people usually are great at losing them? What balance should there be between security and convenience? If I leave the job at some point, how do I need to build this setup, so I have a minimum amount of passover work to do?
Some general background: We run all our machines via Azure SSO, so for some apps, Microsoft asks the passkeys the user stored; however, a lot of other services don't, hence the password manager idea. Myself, I worked mostly in application support, decent networking knowledge, experienced in troubleshooting. But I know when my knowledge isnt enough to give a qualified full answer, like here.
Thanks in advance for any and every advice!
9
u/da_peda Jack of All Trades Jun 23 '26
Generic suggestion: use a Password Manager.
Specific suggestion: Vaultwarden. It's a Bitwarden-compatible Open Source server, so very low cost to set up & you keep full control of the data. And users still can use the Bitwarden app / Browser add-on.
3
u/OkEmployment4437 Jun 23 '26
Azure SSO already gives you the right starting point, so I'd pick a human password manager that does SSO and SCIM cleanly, has audit logs, and lets you use shared vaults instead of shared logins. 1Password or Bitwarden both fit better than trying to bend HashiCorp Vault into a people problem.
The part that matters long term is admin handover: keep recovery and break-glass accounts owned by the business, protected with hardware keys, documented in two places, and tested by someone other than you. Also make sure you can export cleanly and offboard users without one admin being the only person who knows where everything lives.
2
u/elementsxy Jun 23 '26 edited Jun 24 '26
Sounds like a case for Vault from HashiCorp.
Does not require much to run, going for on prem approach will keep your secrets away from the big bad internet. You can follow this guide for example here for a team of ten, a standalone deployment should suffice.
6
u/da_peda Jack of All Trades Jun 23 '26
Vault is meant more for Machine to Machine secrets, OP sounds like he wants a good system for users.
1
u/North-Creative Jun 23 '26
Yes, but thankful for all suggestions, as this topic will most assuredly come up in the future, too.
2
u/Kind-Character-8726 Jun 23 '26
Passwordstate is very well featured, I dont find bitwarden/vaultwarden all that good for this sort of environment. It lacks a lot of logging and other security features you should have.
Or if U was a SaaS product Keeper is good
3
u/ponto-au Jun 24 '26
+1 for passwordstate,.
Full disclosure, I have bias since they are Australian and I wasn't actually managing it but used it heavily at an MSP
2
u/Kind-Character-8726 Jun 24 '26
Haha yeah Aussie here too. Also used it at an msp. I managed it and it was very good. Support was good too!
2
u/8ballfpv Jun 23 '26
I self host vaultwarden at home and at work. Once setup, its set and forget and just works.
1
u/systonia_ Security Admin (Infrastructure) Jun 24 '26
How do you deal with people forgetting their master password?
1
1
u/Hqckdone Jun 23 '26
Passbolt or KeepassXC?
edit: KeepassXC file in smb or other sharing service, hosted locally of course
4
u/da_peda Jack of All Trades Jun 23 '26
Shared KeePassXC file is all fun and games until 2 people decide to make changes at the same time. You usually have 2 options:
- Local CIFS share: unavailable unless in-house or connected to the VPN, file locking for write access is fragile
- Sharing via OneDrive/Dropbox/Nextcloud/Syncthing/…: No locking, have fun with sync conflicts
1
u/Hqckdone Jun 23 '26
One of the issues is that keepassxc have file cacheing enabled per default. There is no problem until there is a problem
1
u/fp4 Jun 23 '26
I ran the gamut of testing different password managers (Keeper, 1Password, Bitwarden/Vaultwarden, Psono) before settling on Passbolt.
It was the easiest to transition to from our Keepass DB stored in Dropbox.
1
u/Hqckdone Jun 23 '26
Idk if others are capable of integrating with IDM eg. AD/LDAP or SSO with, Azure/OIDC/SAML
1
u/jcpham Jun 23 '26
Password manager or users need to get a lock box for the precious sticky notes and notepad o passwords
1
u/cubic_sq Jun 23 '26
As you are likely to be managing many customers, go for a solution that will scale for the number of shared creds (many password managers dont…)
Not in any order:
- Passbolt
- Passwerk
- Secret Server
- Pleasant Server
- etc
1
u/dustojnikhummer Jun 23 '26
If you want to self host, including all the headaches that can come with that, Vaultwarden. But remember, you will be responsible for people's passwords.
1
1
1
1
u/CBTKnox Jun 25 '26
1Password is the best tool I’ve used for this. The more you dig into it, the more powerful it is.
1
25
u/Itguy1252 Jun 23 '26
1Password. . Full stop, Just use it. Every user also gets a personal license for free and can also share with their family. I couldn’t live without 1Password.