• Quick note - the problem with Youtube videos not embedding on the forum appears to have been fixed, thanks to ZiprHead. If you do still see problems let me know.

Password Magement

Hellbound

Merchant of Doom
Hellbound
Joined
Sep 16, 2002
Messages
15,112
Location
Not in Hell, but I can see it from here on a clear
I'm looking at some solutions for an Enterprise-level password management system. We have numerous passwords for various Active Directory and -ix service accounts, database users, applications, and similar. Our network is primarily Active-Directory based. The problem we have is that several accounts are rarely changed, and often only a few people have access to those accounts. Over the course of a year, people get fired, leave, change departments, lose documentation, and similar.

I'm looking at comparing products that can safely store and control access to the various passwords. This will provide better security, cetnralized management, controlled acces, and backup capability in case of the unforeseen.

I'm comparing three products at the moment:

Manage Engine-Password Manager Professional
Thycotic-Secret Server
LastPass Enterprise

I'm wondering if anyone here has any experience with any of these products, and could provide some additional information on them? Specifically some information on:

Active-Directory integration
Management of Passwords (how it records/notifies of changes, role assignments, how users access the passwords, how administrators access the passwords, and so forth)
Security (who has access to the accounts, and does access ot the account equate to access to the password, or just access to what it protects?)
Any other general observations (reliability, speed, resource use, etc)

Also, if someone has worked with another product that has been useful, please point me in it's direction. We're needing somethign that will support from 10 to 100 users (it will be at least my team, possibly our whole section using it), 100 to 1000 accounts, and that can run on a Windows box (Server Enterprise 2008 R2 or Server 2012).

ETA: All helpful responses will be rewarded with virtual bacon.
 
The big bank I work for uses PAR (Password Auto Repository) which does things like provide one-off passwords for privileged accounts within maintenance windows etc. My exposure is largely via the API to enable a privileged SQL server account to be used in a db maintenance suite. It's extremely paranoid and, where it doesn't match your requirements, runs in a custom box. FWIW.
 
Wudang:

That sounds interesting, actually, and a hardened appliance is excellent. As for paranoid, that's good, too. We deal with health, financial, and personal data, so paranoid is pretty much a given :).

Unfortunately, the appliances seem to be Dell products...we primarily deal with HP, so I'm not sure how we can swing that. It goes on my list for evaluation, though.

Here's your bacon:
nf_bacon_longevity_0508.jpg
 
It's best to Mage your passwords by a Triple Hex Enduction spell. This way you have to swing a red cat at noon before it will unlock your theographic one-time memory of the passwords themselves.
 
Donn said:
It's best to Mage your passwords by a Triple Hex Enduction spell. This way you have to swing a red cat at noon before it will unlock your theographic one-time memory of the passwords themselves.
Click to expand...

Problem there is that his strategy seems to be bacon-centric which would leave him open to an out-of-cheese-error and he'd have to redo from start.
 
Doh! Figures I'd typo the title :)

Actually, Wudang, wanted to give you a thanks again. It looks like PAR has been purchased by Quest software, which is associated with Dell. They call it Dell One Identity now. I didn't realize there were appliance-based solutions for this, but we much prefer appliances when possible (simplifies security and administration). And Dell One has multiple modules, meaning that if we can get it approved, it can be expanded later for other areas/departments, and it will cover -ix systems and mainframes, which we have.

Looks like that really fits the bill. Now if I can just overcome our institutional resistance to Dell equipment...
 
The only caveat I'd give is that ops tell me it's very sensitive to anything it thinks may be a physical attack such as a fly belching 3 rooms down so you'd need a contingency server as well to protect from lockdown.
 
Yesterday's Fresh Air featured an interview with a reporter who has tried for the last year to as much as possible make herself invisible and untouchable on the web.
She says it's nearly impossible... If you want access to information quickly.
She spent some time on passwords and password generation and security.... All of which seems ultimately somewhat futile:

http://www.npr.org/blogs/alltechcon...-you-think-youre-anonymous-online-think-again
 
tsig said:
Then Bacon and Cheese on Toast is the Holy Trinity.
Click to expand...

Only if the cheese is in the form of a sauce made of onion, white wine, double cream (aka “heavy” cream) and blue cheese. I favour Oxford Blue myself.

Poured over the bacon on toast – I salivate to think of it.

And add finely chopped reconstituted dried porcini mushrooms. I think I'll go and lie down with an ice pack on my forehead for a while.
 
Last edited:
Well, one update.

After getting a price quote, we probably will NOT be going with the appliance. If this were an enterprise-wide project, I could probably sell it. But they want $30,000 plus another $6k per year for support for a non-highly available solution. To get HA, we'd jump that to $43k and $8.6k/year support. And that's just for password management...doesn't include the modules for roles-based assignements, one-time passwords, or support for -ix platforms or other devices.

That's a bit much. It does have capacity, though. If desktop and some of the other areas were buying into it, that would probably end up cheaper with the volume.

However, for current needs (even if all the servers were in, we only have a thousand or so), we can get a software solution that does everything, in a highly available mode, for $10k (including the cost of new servers...well, the resource usage for new VMs anyway), with about $2k per year support costs.
 
You must log in or register to reply here.

Back
Top Bottom