Sysadmins, how do you store and manage passwords?

Not today, Russia.

The method of champions. Post-it on the bottom of keyboard.
- Bottom of keyboard? Are you out of space on your monitor to place additional Post-its with user credentials on them? /s
  
  Boss, I need a third monitor, I'm out of space for post-its
  
  Monitor bezel is for the less secure systems. Under the keyboard is for the secure stuff.
  And the really secure systems are in the filing cabinet.
- Got a thrift store keyboard. The pink sticky on the bottom said:
  User: admin
  Pass: password
  I wish I was joking. Someone out there was dumb enough to need a reminder on that one.
- I would need a small book hidden under my keyboard. My work password safe has approximately 100 entries.

more dev than sysop, but: bitwarden

I write it in plaintext then email it to myself. For my email password, I write that down on a sticky note next to my monitor with my webcam pointing towards it with Skype and Zoom always running so I can look at it when I'm not at home. I always make sure to turn 2FA off as well, since that gets annoying and isn't very convenient.
I might choose to mirror the webcam stream to a public RTMP stream later, but not sure yet, since I think that might open up some security holes.
- This is exactly the kind of innovation I was looking for.
- Also, if you use a really easy to remember password... I like P@ssw0rd! Easy to remember, and nobody will ever guess it because, get this... The 'o' is actually a zero!
  
  Your password shows up to me as ************

We use Netwrix Password Secure at work. They just announced this week they have found a RCE vulnerability in their software...

We use PasswordState at work and KeePassXC for personal passwords.

Bit Warden, one password, whatever float your boat just not last pass.
For SHTF stuff GPG.

Bitwarden/KeePass for MFA (not SMS or email) protected accounts. Pen and paper stored in a fire proof vault for non-MFA and break glass accounts.

correct horse battery staple
- Always a relevant xkcd

As an admin for a Linux server, I want to institute a ssh pub key expiration policy for all the users and enforce non-reuse of old keys. Does anyone have a best solution for this?
- Sounds like certificates to me, but I don't know of any such solution
  Edit: I found out that openssh allows the logon with a certificate. This guide shows how to setup a public key that expires after 52 weeks.
- How do you do your pubkey deployments? If you use ansible, it should be simple enough.
- https://smallstep.com/docs/tutorials/ssh-certificate-login/
  https://sssd.io/

We use ITGlue because it lets us tie password records to documentation which makes finding things very streamlined.
Personally, I use Bitwarden

We have a KeePass DB as a fallback but mostly use a PAM solution to manage server access.

Keepass
- Keepass x2

Scribbled on the whiteboard in the office.
jk
- I would never scribble my password on a whiteboard. It's important to write in large clear letters so I can read it from across the lab.

On a post-it note stuck to the monitor.

At work I keep them in onenote (they are encoded) because they won't let us install an actual password manager and half the shit I log into doesn't support SSO/doesn't have it set up and is all on different password schemes. Our service account passwords are in a shared cyberark vault.

Bitwarden self-hosted with vaultwarden on my Hetzner VPS

Personally, 1Password, but their enshittifaction is serious.
Work, Password Safe. But we’re moving to CyberArk.
- I've been using 1password for over a decade. I'd love to know more about the enshitification you're seeing.
  
  I just looked back and my first vault item dates back to 2010. Time flies.
  I think enshittification is slightly an overstatement. They’re under VC pressure now and moving aggressively towards a subscription model with capabilities increasingly behind the subscription. I bought a few licenses for Mac and PC a while ago; the software still works but no browser extensions - need a subscription for that. Also, take a look at their job postings. Same job pays double in USA vs Canada. Funny way to do things if they’re Canadian.
- Why do companies name their password safe "Password Safe"? Thats about as relevant as naming a phone "Phone".
  
  It was a password safe before password safes were cool. https://www.pwsafe.org/2002.shtml
  
  See the Nothing Phone (2a)

I don't understand the extreme love for Bitwarden. I understand it's useful, but I want as few things with a webui and server instance as possible, especially passwords, the thing that should be most secure.
KeePass, vault saved into the user's One Drive synced folder is sufficient. It's secure, offline, and automatically makes backups. And migrates to the new system just by logging into One Drive.
Bitwarden and others worry me because they have a lot of exposed attack surface, comparatively, and require much more maintenance to keep secure imo. I don't want to expose any of that to a portal or anything.
That said, I don't hate Bitwarden, the bitwarden/vault warden software is incredibly solid for what it is.
- OneDrive
  offline
  ...shoukd we tell them?
  
  You can access it offline.
  I do not mean to imply the One Drive is offline. It's the syncing backend.
  But if your internet is out, you can still open your vault and look up a router password, for example, because the vault is a file on your local machine.
- https://bitwarden.com/help/cli/
  If you’re concerned about security audits they do those regularly too
  https://bitwarden.com/help/is-bitwarden-audited/
  In addition to free as in source, they are respected because they have a high-quality, certified, third-party audited product.
  
  Oh certainly. I just mean that in an extremely broad sense, Bitwarden adds 1 more threat vector by being an online service. As a metaphor, if presented with a safety deposit box in a bank, and a safety deposit box in a train station with CCTV, even if the latter is incredibly well defended it still carries more intrinsic risk by being accessible.
  That's all really. Bitwarden is great software. It being an online platform just has that inherent factor that a non-web solution doesn't.
  Aka, if there is a massive breach in webview or a critical fault in SSL cryptography, this can be exploited. And Bitwarden itself is an attack surface to exploit. But in an offline solution, the attack surface of a vault can only be exploited when you get back online, and somehow actively choose to expose this or have a breach. The reason I use onedrive for the work sync (privately I use syncthing) is it would take two massive simultaneous failures to have an exposure this way. The sync service would have to somehow expose the file to a bad actor, and the file itself would have to have an exploitable cryptographic flaw at the same time.
- The actual answer will always be convenience. It’s just too easy to be able to smack my thumb on the fingerprint sensor to login to just about anything.
  I understand your point on security, but for the masses, it needs to be as frictionless as possible.
  And getting someone to use BW over nothing is a massive improvement even if it’s not perfect.
  
  This is incredibly true. The ease of use I will admit got me to use other password managers in the past before I rethought my approach maybe 7 years ago. And any manager is better than the spreadsheet users will implement if we dont give them tools.

For actual sysadmin stuff? Ansible vaults. Things that are managed otherwise either in ssh blowfish encrypted files or the company 1password thing (not my choice)

I tattoo them on my thigh like everybody else

Self-hosted Bitwarden only accessible from behind my self-hosted VPN.

Used Keeper at my last gig. Was pretty happy with it all in all. Lacking some admin features, rock and roll support. Not too pricey, but it is per-user/per-month. Played nicely with our Google auth.

Keepass.
Backed up in the cloud, with a long password with plenty of non english characters in the password.
For learning new passwords, I write them down on a note in my wallet, without any explanation of where they lead or what username to use.
- The same basically. For the real paranoid stuff I have the keepassx file in a veracrypt container.