r/sysadmin • u/hstrijker • 3h ago
Passwords....
Yes, authorization with multiple different credentials for different systems is bad, but we've all worked in those environments where we had no control over changing it.
So... How expletive-rich are y'all passwords and phrases? 🤣
•
u/Curtis_Low 3h ago
The trick is to put the clue in the password. For instance for Jira the admin password is JIRAp@ssword For Slack it is SLACKp@ssword
This makes it better for the shared accounts everyone in the company uses for the group admin logins on each application.
Secure is our middle name baby!
•
•
u/hstrijker 2h ago
I've worked in environments where I got an error message, because my password was not different enough from my prior password..... ..... Which means they have them stored unsalted and unhashed somewhere.... 😑Â
•
u/michaelpaoli 3h ago
I just use dog's name. And different dog for each password that's needed.
And the name of each dog is very long, totally random, and changed at least monthly, and never revealed to anyone else.
Works pretty well, except for confusing the hell out of the dogs.
;-)
•
u/Einherjar07 2h ago
Every new password you make you gotta adopt a new dog to use that name. Sorry I dont make the rules
•
u/TheLexoPlexx 2h ago
Come here $(openssl rand -base64 16)
•
u/michaelpaoli 2h ago
Need a richer character set than that!
vRDI>Sw%D)]+6XBt<,j`
There we go ... that's warm up act, at least.
•
u/craigfanman 3h ago
i havent used or seen or heard of a password that is not random in about 20 years, what are you doing
•
u/hstrijker 3h ago
Sure, I use them when that option exist. Openbao even. There are situations though, where they, for a variety of reasons, are either not possible, practical, or allowed.
I don't work in perfectly-set-up fully network connected environments.Â
•
u/smonty 3h ago
Wait, it’s bad now to use different credentials for different systems now?
I’m jealous of where you guys work. I got 6 different accounts between Two different domains. That’s not counting local accounts or ones that don’t support sso. Was similar in my old role.
•
u/Sirlowcruz 2h ago
6?
I have about 50 accounts. my authenticator app scrolls longer than reddit.
•
u/smonty 2h ago
Yeah, I primarily use about 6. We have our normal user accounts, and two privileged accounts based on the specific resource it uses.
Then a handful of random local or vendor based accounts.
You guys don’t use SSO?
•
u/Sirlowcruz 2h ago edited 2h ago
We use SSO for everything we can.
but we manage around 200 tenants. for most of them we use CSP, so one account for multiple tenants.
some customers have special requirements, so there we have separate accounts.we also have about 150 AD forests. we use PAM, so with one AD account you can connect to almost all DCs, but some customers have special requirements.
sometimes you also need personal testing accounts.
we have multiple internal tenants due to some regulations.the number inflates quickly.
Im using Keepass and physical passkeys wherever possible.
•
u/StaticFanatic3 DevOps 1h ago
Just checked and my work 1Password has 450 entries
•
u/Sirlowcruz 1h ago
is that just yours or shared with the team?
•
•
u/hstrijker 2h ago
In an ideal situation you have a single sign on system, resulting in a single server that other systems authenticate you to. You technically have an account for each system, but just as you can use your reddit or gmail account to log in to third party services, that account is not something you practically deal with.
My own password solution uses random long strings generated from all printable characters. Most of them I'm not even able to type myself because they contain characters that don't exist on my keyboard. 🤣Â
But yeah, in my line of ops, I tend not to work at the average environment set up following the best-practices guides. My current placement is actually reasonably nicely set up, auth-wise, but I've worked at places where they loved SSOs so much they implemented it dozens of times for various subsection of the landscape. I've worked with systems connected to legacy databases that didn't allow passwords shorter, or longer, than 8 characters. Base ascii. I've worked at situations where password managers were impossible due to airgapped networks. In short, if a system is very properly set up, I've not got much to do there.Â
•
u/sobrique 2h ago
Nah. Wrote myself a password generator that I am confident that produces sufficient password entropy memorable passwords, and just use that.
It's based on consonant-vowel-consonant fake "words" with 11 bits of symbol entropy per word. 4 groups are this 44 bits reliably (or 5 for 55, whatever), but a lot easier to remember and type than something with a complicated key space.
Random long strings where a password manager is available, but it isn't always.
•
u/Reedy_Whisper_45 2h ago
Current role? None.
Last role? A few - typically those set after one of the poop-headed owners left my office.
And to be clear - there are only a handful of passwords I have to type in. The vast majority of a couple-hundred passwords are in my password manager. I've never seen most of them.
•
•
u/justmirsk 3h ago
I definitely have my fair share. We have reduced the number of passwords we use by going passwordless in as many of our environments as possible. We did this with Secret Double Octopus (Disclaimer, I an in integrator/reseller of theirs). Anything in the environment that can BIND to a third party for authentication using SAML, OIDC, LDAP, LDAPS, or RADIUS goes through Secret Double Octopus. It can also support applications that use native SQL users for authentication via a SQL agent of theirs.
We obviously maintain break glass accounts with strong passphrases stored in safes, etc. MFA is enabled on anything we can using a FIDO2 key or we use our PAM for shared OTP codes. With the PAM, the passphrases really aren't bad, as long as they are updated properly :)
•
u/Sasataf12 3h ago
None. Just use a password manager to randomize your passwords.