I'm looking for suggestions on the right kind of tools I can use to improve the security and ease of use for managing passwords for my multi-server apps.
I have a couple of ubuntu-based servers running software that need to access user/passwords for access to databases, 3rd party email provider service, logging services, etc.
I've been storing the auth data in a file on each machine set to read only by a process that runs on reboot that pushes them into environment variables that the others can read as-needed.
This has been working ok, but it means manually updating the auth files on each server when information changes. There's also security issues with storing credentials in envvars such as suggested by postgresql:
PGPASSWORD behaves the same as the password connection parameter. Use of this environment variable is not recommended for security reasons, as some operating systems allow non-root users to see process environment variables via ps; instead consider using a password file (see Section 34.16). https://www.postgresql.org/docs/14/libpq-envars.html
At a previous job we had a credential service/api where apps would request passwords as-needed. That was internally written at the company and not open source. I can build something one-off that does this, but I'd prefer not to if there's a mature option.
Haven't been having any luck searching. (Google seems to be getting worse by the day.) Pretty much all results have been about user passwords and things in that vein.
This is probably a case of not knowing enough of the right vernacular to get the right search results.
I found references to keyctl and gkeytool but I can't evaluate if they're what I'm looking for.
Appreciate any advice you can provide.
