Posted by purcell on August 31, 2010 at 7:14pm
My boss and I are looking for ways that we can share documents containing account logins and URLs. We only need to share between 3 users and need to access these files on our work machines, home machines, and potentially lab machines via a web login. I was looking into dropbox (http://www.dropbox.com/) as a potential solution and I was curious if anyone has had any experience with dropbox or any other solutions for something like this.
Thanks,
Purcell
Comments
Dropbox
I am a huge fan of dropbox. It works extremely well and will meet your needs. I also like basecamp if you are trying to file share and keep track of things in a collaborative workspace.
I use dropbox to share a
I use dropbox to share a password database (something like 1password for the Mac) between multiple locations. The file is synced between my machines any time there is a change. The database file itself is encrypted. You can then share a folder on dropbox and the password for the password database.
How much security do you need?
I would like to say that I think that I think this is a bad idea. Users tend to use the same password for many things and if you know, or worse, expose to others, the password for this site then you are possibly exposing things such as their bank account, their medical history, social networking and more.
Remember, keeping passwords in a human-readable format means that if you open the file someone could see it. That is why all professional grade systems do not store passwords but instead use a hash of the password (a hash being an irreversible encryption). Even if the system is compromised the actual password is not disclosed (unless the user gives it to them).
If you put a spreadsheet on a cloud site you have no clue how long that will be in their backup system or if the file is compromised. If you delete it, how long before its really gone? And if you transfer it over an unencrypted connection you can pretty much consider that it is compromised.
--
Matthew Nuzum
newz2000 on freenode
best practices
Realistically, then should I just push for the three users having all the privileges necessary to do their job on each server and that those accounts are likewise admins on all relevant images? With that approach, when we need to track down who made a change, we can track it by account (instead of guessing who used the systems account) and when someone leaves a job, you delete their account and don't have to worry about changing passwords on boxes and accounts.
Never share.
Never share credentials. I'm most concerned with tracking user actions. Each cook needs to be accountable else you run the risk of too many cooks in the kitchen.
Regards,
Michael Hofmockel
Open Source || Open Access || Open Mind
You got it
That's the right idea. Create an "admin" role and grant each of your admins that role and ensure it has the right privs.
--
Matthew Nuzum
newz2000 on freenode
not just credentials for drupal
I am concerned more with access to my web server, backup web server, sql server, proxy server, and admin accounts for the lab machines we administer, not so much Drupal accounts. Everyone has their own Drupal accounts on our sites.
Realistically in terms of best practices we probably should all have individual accounts on all the servers that have privileges to sudo and have our accounts in a group in active directory that have admin rights on the lab machines we maintain. I could then combine that with keeping a password db that contains the login info for less crucial things, say an analytics account.
Would that be a somewhat reasonable practice?
Enterprise credentials
We use our MS Exchange server as domain controller and LDAP for account privileges for inhouse use, which within that scope, works well across a number of our enterprise systems, including a Filemaker server and a system which uses an Oracle db. Once outside of the LAN network and outside the scope of Staff users however, is a whole other story where we have multiple systems with redundant and very often stale information. We are actively looking for a means to manage this better - something like a master database silo of users (Staff, Customer, Partners) and their roles/privs that go well beyond Drupal ...but ideally can be at least partially maintained from a Drupal interface. For instance, allow Customer Service Reps and Sales Execs to enter new customer data and update data such as contact information that would then propagate/mirror to the master database. As plans on paper evolve toward this, the effort quickly becomes a rats nest of multiple databases translating their information back and forth and that is a recipe for disaster - too many triggers and formats that can fail just by running an update. Cannot seem to find that one clean solution.