plugin for credentials

[Farhaad_n]

Hi, I  am using Atlassian software (service management, confluence, bamboo, bitbucket)

Is there any plugin for keeping and storing customer's credentials servers?

I want to store credentials of all my customer's servers, for example, they have 2 Linux servers, I want to store ssh user&pass, web user&pass and ... for each customer

[Nic Brough -Adaptavist-]

No, there are none I'm aware of.

This is probably because it is not a good thing to do.  The more places you store passwords, the less secure they are.  Broadly, there are two types of passwords you might want to configure:

1. Real user passwords - these should only be stored
   1. in the head of the user
   2. in their own password safe that no-one else has any access to
   3. in the user directory used for logging in (but this should be storing a hash, not the actual password, so you wouldn't be able to use it from there). 
2. Service account passwords.  Same as user accounts except that the password safe would be shared

What problem are you trying to solve here?

[Farhaad_n]

number 2

[Nic Brough -Adaptavist-]

"Service account details" are not the problem.  Could you explain what problem you would solve by saving service account details in a vault in Jira?

[Farhaad_n]

Yes sure, I have a company and we install and support many Linux base and other servers for customers, I want store installation credentials (for example ssh user & password) of any customers, so when another support team wants to connect to that server, they can easily use that credentials.

Now, if I have the plugin for only storing these credentials, my team can access those faster and work faster, 

for example, one customer, ticket about one of their server issue, if my team can access to credentials on that issue, it's perfect

sorry if I can't write English very well, I hope you understand what I want 

[Nic Brough -Adaptavist-]

Ok, so the problem is "quick access to credentials".

Exposing them in a Jira issue, which could easily be accessible to more people than you assume, and is accessible at times other than when you are actively working on a specefic issue, is almost the definition of a security breach.

Yes, security is inconvenient, but it is a necessity, and you need to do it properly.

Jira is not the right place to be storing or exposing these credentials.  You should go talk to your security team about the best way to store and use these credentials.  They will never tell you to use Jira for it.

[Farhaad_n]

Is there any feature to only 1 team access to them?

[Nic Brough -Adaptavist-]

You can secure projects or issues individually in Jira, locking them down so that only one team (and your Admins) can see them, yes.  But that's not the right thing to do with access credentials.

[Gaurav]

Hello @Farhaad_n 

I doubt there would be any plugin to store the user credentials. For this purpose, you can explore the secure vaults available, which are not application (Atlassian or any other) centric and allow secure storage of user credentials.

[Farhaad_n]

I don't want user credentials, I want customer servers credentials, for sharing between my workers, I don't know the name of these applications, for example, iTop