Body: <p>I'm looking for suggestions on the right kind of tools I can use to improve the security and ease of use for managing passwords for my multi-server apps.</p>
  <p>I have a couple of ubuntu-based servers running software that need to access user/passwords for access to databases, 3rd party email provider service, logging services, etc.</p>
  <p>I've been storing the auth data in a file on each machine set to read only by a process that runs on reboot that pushes them into environment variables that the others can read as-needed.</p>
  <p>This has been working ok, but it means manually updating the auth files on each server when information changes. There's also security issues with storing credentials in envvars such as suggested by postgresql:</p>
  <p><code>PGPASSWORD behaves the same as the password connection parameter. Use of this environment variable is not recommended for security reasons, as some operating systems allow non-root users to see process environment variables via ps; instead consider using a password file (see Section 34.16).</code> <a href="https://www.postgresql.org/docs/14/libpq-envars.html" rel="nofollow noreferrer">https://www.postgresql.org/docs/14/libpq-envars.html</a></p>
  <p>At a previous job we had a credential service/api where apps would request passwords as-needed. That was internally written at the company and not open source. I can build something one-off that does this, but I'd prefer not to if there's a mature option.</p>
  <p>Haven't been having any luck searching. (Google seems to be getting worse by the day.) Pretty much all results have been about user passwords and things in that vein.</p>
  <p>This is probably a case of not knowing enough of the right vernacular to get the right search results.</p>
  <p>I found references to <a href="http://manpages.ubuntu.com/manpages/bionic/man1/keyctl.1.html" rel="nofollow noreferrer">keyctl</a> and <a href="http://manpages.ubuntu.com/manpages/bionic/man1/gkeytool-5.1.html" rel="nofollow noreferrer">gkeytool</a> but I can't evaluate if they're what I'm looking for.</p>
  <p>Appreciate any advice you can provide.</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-02-20T22:50:23.120Z
Comments: Sounds like something for a secrets management tool, like Vault.
Comments: BMitch
Comments: CC BY-SA 4.0
Comments: 2022-02-22T02:41:19.530Z
Comments: There's the magic words. Yep now that I can search for the right terms there's the options I needed. Thanks!
Comments: Geuis
Comments: CC BY-SA 4.0
Comments: 2022-02-22T07:45:02.963Z
Comments: hI @Geuis - If you'd like an actual answer to the question (and perhaps a solution to your actual problem), could you give some context on the operating environment you're in? This will help to give an accurate answer of how to adopt a piece of infrastructure like Vault.
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2022-02-23T01:17:42.263Z
Comments: @BruceBecker Sure, thanks for the followup. I have 3 ubuntu servers I'm running on Linode. Between the three, they run a variety of node-based services, along with a postgres db, nginx for routing, etc.
Comments: Geuis
Tags: <ubuntu><secret-management><passwords>
Title: Tooling to allow server apps to checkout passwords (database, email provider, etc) on multiple servers?
UserDisplayName: Geuis
ThreadText: # Tooling to allow server apps to checkout passwords (database, email provider, etc) on multiple servers?
  
  (Asked by: username_0 on 2022-02-20)
  
  I'm looking for suggestions on the right kind of tools I can use to improve the security and ease of use for managing passwords for my multi-server apps.
  
  I have a couple of ubuntu-based servers running software that need to access user/passwords for access to databases, 3rd party email provider service, logging services, etc.
  
  I've been storing the auth data in a file on each machine set to read only by a process that runs on reboot that pushes them into environment variables that the others can read as-needed.
  
  This has been working ok, but it means manually updating the auth files on each server when information changes. There's also security issues with storing credentials in envvars such as suggested by postgresql:
  
  `PGPASSWORD behaves the same as the password connection parameter. Use of this environment variable is not recommended for security reasons, as some operating systems allow non-root users to see process environment variables via ps; instead consider using a password file (see Section 34.16).` <https://www.postgresql.org/docs/14/libpq-envars.html>
  
  At a previous job we had a credential service/api where apps would request passwords as-needed. That was internally written at the company and not open source. I can build something one-off that does this, but I'd prefer not to if there's a mature option.
  
  Haven't been having any luck searching. (Google seems to be getting worse by the day.) Pretty much all results have been about user passwords and things in that vein.
  
  This is probably a case of not knowing enough of the right vernacular to get the right search results.
  
  I found references to [keyctl](http://manpages.ubuntu.com/manpages/bionic/man1/keyctl.1.html) and [gkeytool](http://manpages.ubuntu.com/manpages/bionic/man1/gkeytool-5.1.html) but I can't evaluate if they're what I'm looking for.
  
  Appreciate any advice you can provide.
  
  **Tags:** ubuntu, secret-management, passwords
  
  > **Comments:**
  > **username_1**: Sounds like something for a secrets management tool, like Vault.  
  > **username_0**: There's the magic words. Yep now that I can search for the right terms there's the options I needed. Thanks!  
  > **username_2**: hI @username_0 - If you'd like an actual answer to the question (and perhaps a solution to your actual problem), could you give some context on the operating environment you're in? This will help to give an accurate answer of how to adopt a piece of infrastructure like Vault.  
  > **username_0**: @username_2 Sure, thanks for the followup. I have 3 ubuntu servers I'm running on Linode. Between the three, they run a variety of node-based services, along with a postgres db, nginx for routing, etc.  
  
  ---
  
  ## 0 answers
  
  