3

When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password could be to hard for him.

And should I keep other/same admin credentials for myself for later support?

2
  • 1
    Side note: installing an application on the client's server for the first time "at the end of the project" smells like a very unrealistic waterfall approach.
    – Doc Brown
    Jun 1, 2018 at 11:14
  • Why not prompt the user, during installation? Jun 1, 2018 at 15:59

3 Answers 3

2

I would consider giving a temporary password which the admin must change after logging in the first time. Also you need to ensure that this temporary password will be used only by the admin.

This way you would avoid possible breaches and also possible costs of sending the password via post.

4
  • should change or must change (forced by the system)? And send this password by email?
    – Szel
    Jun 1, 2018 at 9:19
  • must. email would be easier. you could also give a call.
    – Mightee
    Jun 1, 2018 at 9:23
  • I can see this generating a lot of support calls if someone other than the expected person logs in first
    – Ewan
    Jun 1, 2018 at 10:06
  • By "the user" you mean "the admin", I guess? And I guess you also mean the guy who installs the software needs to make sure noone else except the intended admin can logon to the system before anyone else does it? If you clarify this, I consider to change my downvote into an upvote.
    – Doc Brown
    Jun 1, 2018 at 12:06
1

Really you should get them to type in the password as part of an install script.

If not possible and assuming you are off site, I would do a screen share where:

  • You remote to the machine and login
  • Hand control to Customer on site
  • Customer changes password without telling you what it is.
  • Get Customer to log off and on again to confirm it works.

Assuming

  • you are a good actor,
  • your connection is secure,
  • the passwords are starred out on the screen
  • and you verify the customer is the customer

Then the new password hasn't been sent across the internet and you have confirmed the removal of the old password

0

Depending on how paranoid you are about the password going astray, email might not be secure enough. Its often not possible to make any guarantees about how the email is secured in transit. Instant messaging solutions (Skype etc.) encrypt traffic, so often present a safer option.

An alternative might be 'dropbox' (the concept, not the company) type services, that provide a one shot download of a file (https://send.firefox.com/, for example).

I wouldnt keep hold of the password after youve sent it (indeed, depending on your business area, this might be dictated by regulations), but add password reset functionality to the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.