Server Passwords in documentation

[Karl_Krist]

Hello all-

I just completed a full documentation project on a program I've been working on for 2 years.  I am absolutely thrilled that is over!  (The documentation, not the coding!)

Within the documentation (which is meant to be printed out) I included various passwords.  I know this should not be part of the final docs...but I'm wondering- What is the accepted method of documenting passwords?

I have:  ColdFusion admin passwords, Windows Server passwords, Datasource Passwords, Application 'universal' passwords, etc.

Where do you put these passwords?  How do I include them in the final printed documentation?  If we have a server meltdown, someone will NEED these passwords to get everything going.  I need to make them available, but I don't want to be stupid.  Suggestions?

My system does not deal with sensitive information- except user passwords.  But, we need to keep things protected...just not at the HIPAA level.

Also...if you haven't done a massive documentation of your current project- I recommend you do it!  The benefits of combing through everything are huge.  Just straightening out all of my accounts was a huge chore, but it had to be done.  Once completed I feel a whole lot better about the future!

[BKBK]

Thanks for sharing this with us. Great work!

It is indeed vital to have such documentation. Nevertheless, you should not put passwords in the documentation. It is common practice, and best practice, for documentation to be publicly available. Whereas passwords must be private.

One common solution is to set up a password policy. This is usually part of a more general software security policy. At the centre of this policy is the owner, the person who has final accountability or responsibility for the software.

The owner stores the passwords in a secure place such as a password management program or a safe, to which access is controlled. Anyone who requires a password requests it formally from the owner. The owner keeps a record of every password issued, including dates, times, purpose, application name, and to whom.

What you then put in your software documentation is a description of the procedure for obtaining passwords. The description may include, for example, the contact details of the person responsible, the conditions under which passwords are issued and the contractual obligations.