I'm looking for suggestions on the right kind of tools I can use to improve the security and ease of use for managing passwords for my multi-server apps.

I have a couple of ubuntu-based servers running software that need to access user/passwords for access to databases, 3rd party email provider service, logging services, etc.

I've been storing the auth data in a file on each machine set to read only by a process that runs on reboot that pushes them into environment variables that the others can read as-needed.

This has been working ok, but it means manually updating the auth files on each server when information changes. There's also security issues with storing credentials in envvars such as suggested by postgresql:

PGPASSWORD behaves the same as the password connection parameter. Use of this environment variable is not recommended for security reasons, as some operating systems allow non-root users to see process environment variables via ps; instead consider using a password file (see Section 34.16). https://www.postgresql.org/docs/14/libpq-envars.html

At a previous job we had a credential service/api where apps would request passwords as-needed. That was internally written at the company and not open source. I can build something one-off that does this, but I'd prefer not to if there's a mature option.

Haven't been having any luck searching. (Google seems to be getting worse by the day.) Pretty much all results have been about user passwords and things in that vein.

This is probably a case of not knowing enough of the right vernacular to get the right search results.

I found references to keyctl and gkeytool but I can't evaluate if they're what I'm looking for.

Appreciate any advice you can provide.

  • 1
    Sounds like something for a secrets management tool, like Vault.
    – BMitch
    Feb 20, 2022 at 22:50
  • There's the magic words. Yep now that I can search for the right terms there's the options I needed. Thanks!
    – Geuis
    Feb 22, 2022 at 2:41
  • hI @Geuis - If you'd like an actual answer to the question (and perhaps a solution to your actual problem), could you give some context on the operating environment you're in? This will help to give an accurate answer of how to adopt a piece of infrastructure like Vault. Feb 22, 2022 at 7:45
  • @BruceBecker Sure, thanks for the followup. I have 3 ubuntu servers I'm running on Linode. Between the three, they run a variety of node-based services, along with a postgres db, nginx for routing, etc.
    – Geuis
    Feb 23, 2022 at 1:17


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.