Sysadmin

Keepass.

Backed up in the cloud, with a long password with plenty of non english characters in the password.

For learning new passwords, I write them down on a note in my wallet, without any explanation of where they lead or what username to use.

Not today, Russia.

The method of champions. Post-it on the bottom of keyboard.

more dev than sysop, but: bitwarden

I write it in plaintext then email it to myself. For my email password, I write that down on a sticky note next to my monitor with my webcam pointing towards it with Skype and Zoom always running so I can look at it when I'm not at home. I always make sure to turn 2FA off as well, since that gets annoying and isn't very convenient.

I might choose to mirror the webcam stream to a public RTMP stream later, but not sure yet, since I think that might open up some security holes.

Bit Warden, one password, whatever float your boat just not last pass.

For SHTF stuff GPG.

We use Netwrix Password Secure at work. They just announced this week they have found a RCE vulnerability in their software...

correct horse battery staple

We use PasswordState at work and KeePassXC for personal passwords.

Bitwarden/KeePass for MFA (not SMS or email) protected accounts. Pen and paper stored in a fire proof vault for non-MFA and break glass accounts.

As an admin for a Linux server, I want to institute a ssh pub key expiration policy for all the users and enforce non-reuse of old keys. Does anyone have a best solution for this?

We use ITGlue because it lets us tie password records to documentation which makes finding things very streamlined.

Personally, I use Bitwarden

At work I keep them in onenote (they are encoded) because they won't let us install an actual password manager and half the shit I log into doesn't support SSO/doesn't have it set up and is all on different password schemes. Our service account passwords are in a shared cyberark vault.

Keepass

We have a KeePass DB as a fallback but mostly use a PAM solution to manage server access.

Scribbled on the whiteboard in the office.

jk

On a post-it note stuck to the monitor.

Bitwarden self-hosted with vaultwarden on my Hetzner VPS

I don't understand the extreme love for Bitwarden. I understand it's useful, but I want as few things with a webui and server instance as possible, especially passwords, the thing that should be most secure.

KeePass, vault saved into the user's One Drive synced folder is sufficient. It's secure, offline, and automatically makes backups. And migrates to the new system just by logging into One Drive.

Bitwarden and others worry me because they have a lot of exposed attack surface, comparatively, and require much more maintenance to keep secure imo. I don't want to expose any of that to a portal or anything.

That said, I don't hate Bitwarden, the bitwarden/vault warden software is incredibly solid for what it is.

Personally, 1Password, but their enshittifaction is serious.

Work, Password Safe. But we’re moving to CyberArk.

Used Keeper at my last gig. Was pretty happy with it all in all. Lacking some admin features, rock and roll support. Not too pricey, but it is per-user/per-month. Played nicely with our Google auth.

For actual sysadmin stuff? Ansible vaults. Things that are managed otherwise either in ssh blowfish encrypted files or the company 1password thing (not my choice)

Self-hosted Bitwarden only accessible from behind my self-hosted VPN.

I tattoo them on my thigh like everybody else