Password Managers for IT Team

[timbo343]

I'm looking at password managers for our teams and at the moment I've whittled it down to either Keeper or 1Password though I've not looked at Dashlane.

 

I've looked at BitWarden but I feel it doesn't quite match Keeper or 1Password. To test BitWarden business I'd need complete a payment sign up to test it.

 

Keeper looks more granular and feels like it has a lot more features but I'm not sure about the Shared Folders aspect given that the Shared Folder resides with the person who created the shared folder, where 1Password gives you the ability to create vaults. It would be good if 1Password could give granular control on each of the vaults or have the ability to create folders within the vaults. If we created vaults for each site, I'd want to limit individuals / groups to what they could see in each of the vaults.

 

As we currently oversee about 12 different physical sites, it then comes down to management / organisation of how the stored credentials are stored. Would it be best to have it organised as School > System or System > School.

[Tefters]

Would it be worth considering devolutions password manager along with their remote desktop manager? Not sure what you use for that.

 

I love devolutions RDM and would implement that if I was in a larger team and their password manager bundled aside just ticks another box.

[mavhc]

Run your own bitwarden server for free with vaultwarden

[Frodo_Baggins]

Used 1Pass and Bitwarden, both worked well for us - currently 1Pass with groups of IT staff per school and vaults for each school, If there are concerns about cert ian passwords and access then have them stored in a vault the users don't have access to e.g. All router\firewall passwords are stored in the IT management vault and everything else goes in the school vault (you can always move the passwords when you are happy for them to access)

[dhicks]

I'm looking at password managers for our teams and at the moment I've whittled it down to either Keeper or 1Password though I've not looked at Dashlane.

 

We're now using Keeper, which we've found issues with the 2FA / "admin approval" process. I'm on my home PC at the moment, running Chrome synced with my school Google Workspace domain account. I can't get logged in to Keeper, although I'm fairly sure I had it working here a few weeks ago.

[timbo343]

Would it be worth considering devolutions password manager along with their remote desktop manager? Not sure what you use for that.

 

I love devolutions RDM and would implement that if I was in a larger team and their password manager bundled aside just ticks another box.

 

Thanks but at the moment we are just looking for a password manager, things could change in the future though.

 

Run your own bitwarden server for free with vaultwarden

 

I did think of this but i'd rather the security and hosting be with the vendor rather than myself - it's just another thing to worry about.

[mavhc]

I'd rather my password vault wasn't on the internet

[dapaulio]

I'd rather my password vault wasn't on the internet

 

I agree, I use keypass.

Local stored encrypted file

[jthompson]

I agree, I use keypass.

Local stored encrypted file

I use KeePass and store my db file in Google Drive.

[gshaw]

I'm looking at password managers for our teams and at the moment I've whittled it down to either Keeper or 1Password though I've not looked at Dashlane.

 

I've looked at BitWarden but I feel it doesn't quite match Keeper or 1Password. To test BitWarden business I'd need complete a payment sign up to test it.

 

Keeper looks more granular and feels like it has a lot more features but I'm not sure about the Shared Folders aspect given that the Shared Folder resides with the person who created the shared folder, where 1Password gives you the ability to create vaults. It would be good if 1Password could give granular control on each of the vaults or have the ability to create folders within the vaults. If we created vaults for each site, I'd want to limit individuals / groups to what they could see in each of the vaults.

 

As we currently oversee about 12 different physical sites, it then comes down to management / organisation of how the stored credentials are stored. Would it be best to have it organised as School > System or System > School.

 

Have you been reading my mind the past few days as this is exactly what I've just been reviewing too with the same results!

 

• Keeper looked really good apart from the way they have passwords owned by a person and just shared into a folder, which is something we've had issues with on another product previously.
  
• 
  
• BitWarden does a solid enough job but their trial and pre-sales has been less-than-impressive, rather strange really.
  
• 
  
• 1Password looks solid if unspectacular, again they weren't interested in engaging and standard pricing is double that of the others. Password breach detection on that product was poor, it let me put some horrific passwords in and didn't flag them despite being in the NCSC 100k most breached list!
  

[Olliedawg]

Use KeePassXC here. Database is protected via a long password & keyfile.

 

Obviously different requirements mean different solutions, but we're a single school & i dont need to share the DB, so this works great for me.

[dapaulio]

I use KeePass and store my db file in Google Drive.

 

Yeah come to think of it yeah I have mine sync to OneDrive

[Norphy]

Have you looked at PasswordState? Free for up to five users

[mraerosmith]

self hosted passbolt instance here

[FN-GM]

Have you looked at PasswordState? Free for up to five users

 

I use it. Works well!

 

Oddly enough, I know someone who worked with the founder. They are based here in South Australia.

[enjay]

My predecessor brought in LastPass, and I've not felt a need to change it. It has a Chrome plug-in, so you just click into the password box and it can autofill from LastPass. There's a mobile app too, which is useful for admin codes on MFDs for example.

[mavhc]

except for that one time someone stole everyone's password file, lastpass is great....

[Jaan]

except for that one time someone stole everyone's password file, lastpass is great....

 

this is my fear

[mavhc]

oh yeah, and it turned out they'd not updated the number of rounds of hashing done, so most accounts were set at 1 instead of 100,000

[jthompson]

except for that one time someone stole everyone's password file, lastpass is great....

Only one?

[timbo343]

I think what we want the password manager to do is:

 

> Personal Vault

> Shared Vaults

>> School 1 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 2 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 3 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

And so on....

 

However it seems that Keeper (and they said they cannot do Shared Folders within Shared folders) and 1Password (cannot do shared folders in vaults) cannot do this and we are unable to test Bitwarden as we need to provide payment details to access their trial.

Edited December 10, 2024 by timbo343

[FN-GM]

I think what we want the password manager to do is:

 

> Personal Vault

> Shared Vaults

>> School 1 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 2 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 3 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

And so on....

 

However it seems that Keeper (and they said they cannot do Shared Folders within Shared folders) and 1Password (cannot do shared folders in vaults) cannot do this and we are unable to test Bitwarden as we need to provide payment details to access their trial.

 

Password state can do this.

[timbo343]

Password state can do this.

 

Cheers - at 8:20 of this video shows it can do nested permissions -

[enjay]

I think what we want the password manager to do is:

 

> Personal Vault

> Shared Vaults

>> School 1 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 2 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

>> School 3 (All users to see this folder)

>>> Wifi (specific users or teams to see this folder)

>>> Switches (specific users or teams to see this folder)

>>> Backups (specific users or teams to see this folder)

>>> DoorAccess (specific users or teams to see this folder)

>>> Servers (specific users or teams to see this folder)

>>> Printing (specific users or teams to see this folder)

And so on....

 

However it seems that Keeper (and they said they cannot do Shared Folders within Shared folders) and 1Password (cannot do shared folders in vaults) cannot do this and we are unable to test Bitwarden as we need to provide payment details to access their trial.

 

LastPass can definitely do this, in the Teams edition, as we have personal vaults for each user, and shared vaults which only specific users can see.

[Norphy]

I stopped using LastPass when they got taken over by LogMeIn. LogMeIn had an absolutely cavalier attitude towards security and I stopped using LastPass as soon as that takeover was announced. I still had something like eight or nine months of paid subscription left at the time but I still migrated to Dashlane for my own stuff.

 

The fact that they had three very public security breaches, two of which beyond serious, further cemented my attitude towards them. Frankly, I wouldn't trust them to secure a piggybank. Which is a shame because they did have a nice product.