Enterprise password managers

The weakest link in your networks security is the human component

Pleasant Password Server

Pleasant Password Server is unique among the products looked at here in that it's based around the free open-source password manager KeePass Password Safe.

KeePass itself has a large following with versions for Windows, MacOS X, and Linux, as well as iOS, Android and Windows Phone and, of course, a portable version for USB thumb drives. As a client, it has one of the cleaner interfaces looked at here, and breaks down logins into categories like Windows, network, internet, and email, though you can also define your own.

The database is encrypted with AES 256-bit as is the norm among password managers, but KeePass takes this a step further and encrypts sensitive data in memory as well, ensuring even if the machine on which KeePass is running has its memory dumped (or is swapped out to disk) private details remain secure. On top of this, any data like logins copied to the Windows clipboard is automatically wiped after twelve seconds, and the database is automatically closed when a machine is locked (such as when the user is away from the PC).

The master password can be alternatively replaced or combined with a key file, increasing security for access to the database, as well as lock the database to a Windows user. This is not merely linking it to the name and password of the user, but the actual Windows account (and its associated Security ID, which is generated unique and associated with the hardware).
The password generator is perhaps the most advanced of the tools looked at, with plenty of options to define how a password is derived, including adding your own pattern or algorithm to the mix.

An extensive set of plugins expand the functionality of KeePass to provide integration with popular browsers Firefox, Chrome, Safari, as well as support for Remote Desktop, online backup providers, and extended functionality like an on-screen keyboard or pronounceable password integration. Pleasant Password Server by comparison is closed source but builds upon KeePass -- and provides its own special version of it -- to supply more enterprise focused features via a centrally managed console and web interface. This includes adding users from Active Directory or LDAP, editing user's profiles, creating Roles to assign permissions to groups of users, and setting password policy.

Bucking the trend somewhat, Pleasant doesn't use or provide a cloud service to store password databases, and instead is designed to be used with a locally managed server.

On the whole this is already a solid offering, with all the features you're likely to need for management via the Pleasant Password Server and secure password management and form-filling via KeePass. However, this can be further extended with another Pleasant product called PasswordProxy, a framework that makes it possible to store and control access to company passwords and other sensitive data, but without employees being able view or access passwords themselves. Instead users are assigned a PasswordProxy account, which is then used via Pleasant Password Server to login to services and websites directly for the user. This prevents not only inadvertent (or otherwise) exposure of passwords via employees, but also stops any malware grabbing login credentials, as they are never exposed on the client system or mobile device.

While KeePass is multi-platform, Pleasant Password Server is Windows only, though it can be managed via any computer through its web interface.

The only feature that appears missing is an in-built method for mass deployment, but beyond this Pleasant Password Server and KeePass offer a tight solution to enterprise password management. In terms of pricing there are no on-going license costs, instead just a one-time fee for the product. A office of 100 users costs $2,720 for 100 copies including the Enterprise addition. Adding PasswordProxy bumps this to $5,745. While there are no on-going license fees, optional support plans are available. These are a fraction of the per-unit cost, but one year is included for free as part of the initial purchase price.

5. PassPack

6. Passwordstate

Tags Linuxpassword managementLastPassCSO AustraliaMacOS Xkeylogging malwareEnterprise passwordnetwork loginsSafenotesPasswords Enex TestLabPassPackPassword valut managerPleasant password serverRoboform

Show Comments