evaluate password management options
during the org/meetings/2017Montreal/Notes/BusFactor session, one of the things that was discussed was the password management system that is (was?) stored in SVN. Specifically:
- We need a better password management solution than the one we have in corporate SVN right now.
- We should look over if the password's in this database should be rotated.
- Figure out if the passwords for paypal have been rotated by Jon et al and ensure that it will be put in the password database. We should also look into the "paypal dongle" or 2-step authentication?
I have some experience reviewing password managers, so I might be able to provide some advice here if someone expands on the requirements and problems with the current approach.
Here are the known password managers currently in use:
- TPA has a
tor-passwordsrepository which uses weasel's pwstore
- administration also store passwords in SVN
- Puppet generates passwords on the fly using a puppet-specific token (this might get replaced by trocla eventually, see #30009)
- Tor browser team's "military-grade post-quantum encrypted point-to-point subspace transmission"
- each worker probably has their own individual password managers, brains, and post-it notes on screens (hopefully no!) which we don't exactly know about
passAKA OpenPGP encrypted files in a git repository, replacement for pwstore
- trocla - already used in Puppet, see #30009
- hiera-eyaml - pluggable encryption for Hiera keys (includes optional GPG support, PKCS#7 by default)
- arver - "tool to manage luks devices and maintain the access of users"