A software development company I work with has a web based product they are successfully selling to clients. All of these clients have a support agreement with us that generally requires us to access their servers, databases and application data. As the number of clients grows, (and the number of different people supporting those clients grows), we are seeing a need to better manage in particular passwords, but more generally all the information one would need to fully support client systems ie. URLs, application login details, IP addresses, any client-specific weird stuff etc etc. This data is changing on an increasingly rapid basis, as systems get moved around to different machines, IP addresses. The worst problem is superuser passwords for the applications. These are constantly changing and occasionally we find ourselves in a situation where nobody seems to know who made the most recent change.

This is clearly an unsatisfactory situation. There are procedures in place which say that password changes etc need to be documented in a central secure place. But of course, people being humans, sometimes forget to document these things. The danger is that when people get so fed up of password chaos, that you can end up with a situation where everyone's password is "password123" as they can't be bothered any more.

Apart from enforcing the procedures, what other approaches could we take? One suggestion I heard was to have a "hidden" application superuser whose password is easily remembered/derived, which only support personnel would know about it. Personally I think that solution is a scary security hole, especially when you have multiple clients using your software.

So how would you handle this situation if you were supporting multiple clients? More strict procedure enforcement, or a technical approach to make life easier for everyone?

closed as off topic by user8 Aug 24 '11 at 13:08

Questions on Software Engineering Stack Exchange are expected to relate to software engineering within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Hi Brian, Programmers.SE is a site for questions about software development: your question is off-topic here. It'd be on-topic on our sister site, IT Security.SE, but similar questions have been asked several times there already. Please take a look at those questions before deciding if you need to ask them for any additional help. – user8 Aug 24 '11 at 13:09
  • @Mark, sorry but I just don't have the patience. It already got closed on SO. I'm looking specifically for software development approaches to the problem, not just security recommendations i.e. are there other programming approaches we could take similar to the one described in my second last paragraph. – TrojanName Aug 24 '11 at 14:46
  • 1
    @Mark and by the way, this "off topic" business has really gotten out of hand. I understood that the Programmers - Stack Exchange was set up to handle questions were deemed off-topic on SO. I don't have time to faff around all day trying to decide which of the sites my question won't get closed on. When you make it harder for people to contribute, then they'll just stop contributing. Same thing happened on Wikipedia a few years, the Deletionists took over the show, and most people I know gave up editing. – TrojanName Aug 24 '11 at 14:48

I have the same problem with all the websites I visit personally, my bank details are pretty important to me!

so I use Keepass which is a little DB of passwords and associated information. Put all your passwords and IP details, etc in there. Its easy to use and very secure - you can then give out a single password to support staff (and/or a key file) that they use to open the db file.

Then put the db in a version control system so you have to check it out to modify it. This adds a level of 'who did what' to the file, but also (if set up right) allows them to check it out remotely and always get the latest version, whilst still being secure in non-secure environments (ie if I go onsite, I'd want to be able to get the latest version over the internet, or a vpn).

It won't stop people from changing the password on the site and not telling anyone, but nothing will solve that problem short of "human processes" (and a stern talking to from the boss if they fail to comply).

In short - there is no easy way to resolve the problem of people not telling others what they've done. The only technical approach that helps here is to provide a central system that is easy to modify and read so people get in the habit of using it.

  • "Dittos." I use "Password Safe". It's pretty good, but only one person can open the file for editing at a time. (But this is usually not a problem, as passwords are used much more often than they are changed.) – Jeff Grigg Aug 23 '11 at 14:38
  • Thanks for this. I use Lastpass myself but didn't think it was suitable enterprise wide. I really like your version control idea too. – TrojanName Aug 23 '11 at 14:42

Check out Secret Server -- was built by a software company to solve just this sort of issue -- any sort of secret can be securely stored and there is room for some local notes.

If you need more information that that, I'd advise a wiki and perhaps an issue tracker. We find that redmine handles this perfectly as the integrated issue tracker/wiki helps feed itself.


I suggest that you use an application or document management tool that allows you to keep details about each customer in 1 or more documents. Then you create security rules to access each type of information or each customer. Have a supervisor perform a check on a periodic basis to make sure that the information is documented and that documented information is correct (by testing it). Have an admin. to manage this application.

  • Thanks. That's basically the same procedure we use now, but we need some good tools to back it up. – TrojanName Aug 24 '11 at 8:58
  • All you need is a basic document management system - Say Google Aps or Zoho Documents. – NoChance Aug 24 '11 at 11:38

If all your websites have a centralized authentication system, then it would not be too difficult to do the "superuser" thing in a secure way. That is, coupled with a role-based security system, you could create a "superuser" role that all your support personnel would be added to, and each website you develop explicitly allows "administrator" access to anybody in the superuser role.

  • Thanks Dean. We already have that - the problem is when you have 50 or 500 clients, each with their own frequently changing passwords. It's a headache. – TrojanName Aug 24 '11 at 14:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.