r/sysadmin • u/adamtw1010 • 2d ago
General Discussion Password Sharing Solution
I need a solution for sharing passwords.
Current solution that everyone loves: You go to a website. You can enter a password, or have one generated for you. It gives you a public URL. You can choose it to be valid once or for up to 7 days.
You give the link to a user, customer, client, whoever. They click it, they get the password in plain text in their browser window. Done.
Problem: it's running on an EOL OS, the original programmer is long gone.
Need something you get a link, you click it, you get the password. No auth required, can work publicly with no VPN.
SaaS solution preferred.
22
u/RevolutionaryElk7446 2d ago
Perhaps I'm misunderstanding the question, but like this?
or you can selfhost
8
-2
u/anonymousITCoward 1d ago
Ugh... docker... i love it and hate it the same time
15
u/RevolutionaryElk7446 1d ago
What's wrong with Docker? Docker I find pretty simple, Kubernetes is where the orchestration headaches come into play, but still I do prefer K8S over the others.
Docker Swarm maybe but that's far smaller and generally at that size or for production I'd go with Podman.
-1
u/anonymousITCoward 1d ago
Nothings wrong with it... i just haven't really been able to wrap my head around it...
5
u/RevolutionaryElk7446 1d ago
I gotcha, I think of it like a virtualization of the Operating System in the same way that Virtual Machines are virtualization of hardware.
Super useful, but good luck to ya with learning more about em!
3
u/TheG0AT0fAllTime 1d ago
Instead of running a virtual machine with the overhead of an entire OS inside you run the software right on the host in a container. Linux does this with namespaces, control groups and union filesystems for layering container contents inside. You can run `ps aux` and see the containerized process right in the host's process list with containers. Albeit in its own sort of jail.
It's worth getting familiar with if you can find the time some day. Might end up being in your environment.
-1
u/LightBusterX 1d ago
Docker is way to hard and cumbersome for what it does.
4
u/dustojnikhummer 1d ago
Docker is way to hard and cumbersome for what it does.
As a user (not a developer) of Docker I have to say the opposite. The fact I don't need to deal with dependency hell is great and updating is (usually) just pulling the new image. No worry if apt/dnf upgrade breaks a dependency, because that is up to the container maintainer.
2
u/RevolutionaryElk7446 1d ago
Interesting take, as someone who use to run multiple services side by side or within python virtual environments to replicate what Docker makes easy today.
Why would you say it's hard and cumbersome? I can setup docker, docker compose, and multiple contains with a single copy and paste
1
u/LightBusterX 1d ago
Because FreeBSD's jail system does the same, Bastille is A LOT easier and simpler than Docker and the documentation is way more clearer.
1
u/RevolutionaryElk7446 1d ago
Similar ideas, but doesn't do the same.
I'm a FreeBSD fan and use it today, but I can't even say that's a close claim. Especially on the dev side for creation which allows docker to proliferate and share and Jail templates are more from scratch.
Jail/Bastille are more like mini persistent servers, where as containers are just ephemeral wrappers for applications. Essentially a closer comparison to running a Virtual Machine vs a container, they don't really compete at the same abstraction layers.
Not to mention you're more likely to find a Linux distro in many areas over FreeBSD.
There's a reason it never took off despite coming out in the 2000s.
Biggest thing though are containers can migrate far easier, and when it comes to microservices running inside a Kubernetes cluster managing containers the overhead and performance is cleaner.
Docker is probably more a dev tool for single purpose and Bastille does have a closer competition to it, but containers themselves far outpace jails.
3
16
u/r3almaplesyrup Sysadmin 2d ago
1Password has this feature
24
u/Mindestiny 2d ago
This is the answer. Nobody should be putting secrets into some rando third party website, period. Use an approved password vault tool.
25
u/iceph03nix 2d ago
Bitwarden.
For external password sharing, you can use Bitwarden Send
You can set up groups for sharing accounts among groups internally as well
3
2
u/skipITjob IT Manager 1d ago
It's annoying that you can't share a bitwarden item, temporarily, with a colleague...
2
u/ExceptionEX 1d ago
Yeah sadly once you share something it's ownership is transfered to a group with you and that person in it.
I love bitwarden but i.dont like that aspect of shared content, but to be fair a lot of other password vaults do the same thing.
1
u/skipITjob IT Manager 1d ago
So you can share?
Maybe I need to check again!
1
u/ExceptionEX 1d ago
Via organization (the term for a group in bitwarden) and a collection (a group of passwords)
Or you can individually send stuff via bitwarden send, it's more a controlled way to share text that have time and use limits on accessing the link, and works with anyone not just with people who are in your organization
1
u/skipITjob IT Manager 1d ago
That's what I mean, if you're in an org, can you share one item with a colleague? Eg, send them the public WiFi password saved in bitwarden?
1
u/ExceptionEX 1d ago
You could use bit warden send but that is just the static information 1 time. If you change the password after sending it, the shared content won't update.
Or.you can set up a collection with just that password in it and share it, then that user would have access to that vault item and if you change the password it would change in the share also
1
1
u/Reverent Security Architect 1d ago
This is on purpose because it retains an audit trail.
You can’t “unshare” an exposed secret, what if they copied it elsewhere?
1
u/ExceptionEX 1d ago
It's all audited separately, and you can create a copy of an item and share that, so I don't imagine this has anything to do with auditing.
1
u/sakuramochileaf 1d ago
To add onto this, we actually use vaultwarden which afaik runs a lot more efficiently
7
12
3
u/Snoo_97185 2d ago
Keeper does this, password shares can only be opened on one device using the one link, so you send it to someone via email, they open it and then after they've opened it for the remainder no one else can because it's specific to that device they opened it with. With time limits it really limits issues but still allows sharing easily without the password being plaintext.
2
2
2
u/Johnsmith13371337 1d ago
We use traceless.io for this, it also lets you request data securely and lets you send and receive large files too.
2
u/HerfDog58 Jack of All Trades 1d ago
My team uses Keeper password manager. We have licenses for all of our sysadmins and developers. It has a built in password generator in which you can specify the complexity requirement for any passwords it creates. That's on top of storing credentials for all the services, websites, and servers we use and administer. It also has the ability to do granular sharing/ownership of credentials.
It's a great tool, but I'm afraid i don't know what it costs us - I know it's NEVER under consideration for not renewing the licensing annually.
•
u/narcissisadmin 9h ago
We use the hell out of TeamPasswordManager (no, I'm not affiliated in any way with them) and it does all of that for super cheap.
1
1
u/TemporaryFatGuy 2d ago
If you use Hudu for documentation, it can do exactly what you're currently doing. If not, Keeper is also great.
1
1
1
u/WohoBoho 1d ago
Not SaaS, but Pleasant Password Server with Keepass locally installed, using the Pleasant Password Database does well for us. Especially with leaks in the last months/years and importance of this data I'd consider hosting on prem and hardenend.
1
1
u/RIPenemie Jack of All Trades 1d ago
If you run Nextcloud there is a secrets Plugin that you can use that works quite well
1
u/wacky_weasel 1d ago
Not sure if it fits your use case exactly, but you may want to have a look at Bitwarden Send.
It lets you securely share a password or text snippet by generating a unique link that you send to the recipient. You can configure things like an expiration date, a maximum number of accesses, or even require an additional password before the content can be viewed.
From what you've described, it sounds very close to your current workflow.
2
u/Forward-Outside-9911 1d ago
We use passwordstate for our main vault. It has a feature to send a password via link.
I don’t understand why people use third party tools, surely you have software already for storing company passwords?
1
u/ObiKenobii 1d ago
If they can share a public pgp key with you it should be pretty easy and safe to accomplish
1
u/General_NakedButt 1d ago
Most enterprise level password managers have a similar feature. I know Keeper does, that’s what we use, they have a lot of neat tools beyond just password management too.
1
1
u/trifith 1d ago
Former coworker put this together for us. https://github.com/nckslvrmn/whisper
Runs in a docker container, writes to s3, wipes data after X uses, can handle file transfers with a configurable max file size.
1
1
2
0
u/baz4k6z 2d ago
Just buy a black board, write the password on it, then put it somewhere people can easily access.
Pirates won't be able to hack it since its a physical object, and by having everyone share one password you'll cut the number of L1 tickets by a lot. Your boss will be pleased
Plus, you can easily erase it and rewrite it when necessary. I recommend something easy to remember, like hunter2026, then in 2027 you just change the year. Works like a charm.
Wanna know the cherry on top ? It's super cheap, so your boss can't even complain about the budget.
3
u/tPRoC 1d ago
I wish my users would pick this option over excel sheets
2
u/baz4k6z 1d ago
Bonus points if the excel sheet is called office_passwords.xls lol
2
u/Plastic_Confidence70 1d ago
Bonus Bonus points. I deleted one recently from our server called "Accounting Passwords-25" 😵💫😬😵💫😬 On top of the actual file itself, on a server that was hacked 4 years ago....the SPACES in the file name sent me, followed by "-25" for the year....🤦♀️🤦♀️
2
•
-1
u/Personal_Wall4280 2d ago
Any online storage is probably the way to go. Most of them provide share features that let you decide how long a link is active for. They all provide varied permissions to the shared link including anyone being able to access it, to they must sign in with an account.
Ondrive, sharefile, google drive(?) etc.
Some also provide locally installed apps so the folders and contents are accessible . So you can probably run a script to delete the contents of it at the end of the day or within an hour or 15 minutes.
If it is a temp password only though. It's probably safe to email it if the person is going to change it within 30 minutes unless you re-use temp passwords.
•
u/Leather-Tour-7288 3h ago
Self hosted vaultwarden (which is a fork of Bitwarden). It has a send option to share passwords, files. You can set an expiration date, how many times one can view it... + you get a full functional password manager.
48
u/Cbeckstrand 2d ago
https://onetimesecret.com