Comments (3)
Hum I don't really understand your point.
Of course if someone get access to a database, then he can do whatever he wants.
Let me in with a mysql account in a Mysql database of any existing tool and I promise you I can do many changes ;-)
Of course such an account has to be protected and should only be known by an administrator.
It's normal that even with playing with this table on personal item, you can't see the pw because they are encrypted with a personal salt key.
Perhaps did I badly understood your point, can you be more precise?
from teampass.
Doesn't look like you misunderstood him. This is the same as with every (web)application, if you have/gain local access to the machine hosting it (or just the database) gives you enough power to grant yourself more rights.
Its your responsibility as a TP Admin/Master user to setup access limits to the server.
from teampass.
Well, the problem our information security manager has is that the TP Admin may not have the need to know all the shared passwords in the database. Some he may not be supposed to know. He should not be able to grant himself (or anyone else) access to sensitive data just because he has root access to the database, or the god role.
For example, the combination to a safe with $5 million is kept in TeamPass, only accessible to the VP of Finance, the CEO, and his lovely secretary (corporate politics, I guess). The Linux Admin is paid $52K/yr, and sees this as an early retirement in some far-off land (maybe with the secretary). He should not be ABLE to grant himself or anyone else access to it - once it belongs to a certain role, only that role manager (not "god") should be able to grant access.
It is not a matter of trust, it is a matter of access. Best practices means you don't have to trust him to not give away the keys to the kingdom - if he can't do it, the question never comes up.
The way TP is set up, this does not work on personal passwords - even if you grant someone access, they cannot see them, and if they could, the salt key prevents them from decrypting it. We have been cleared to use it for personal (non-shared) passwords only.
Nils, I really like the software, and I think you did a great job here, this is just the restrictions imposed on me by the company. If you see this as a "non-issue", then please close it out.
Thanks.
from teampass.
Related Issues (20)
- Installation Troubleshooting
- Google Authenticator code is wrong
- CSV data model Folder ID?
- API : Create Item response folder id don't exist
- Error Import from CSV
- Password viewer
- TeamPass 3.1 Create users "Account is currently being encrypting" HOT 2
- Problem to update from 3.1.2.26 to 3.1.2.45
- I can delete Root folder even if I don't have permissions. HOT 2
- Teampass 3.1.1 Install issue HOT 3
- Mot de passe inaccessible suite upgrade HOT 1
- Update version 3.0.0.17
- Can not read password because `visible_folders` is empty
- TeamPass Installation on Windows Server 2022 HOT 1
- Where table processes_logs ? HOT 1
- Create key for API not working
- On Roles, when I try populate grupos using ldap syncronization button only appear one group
- Error OTP from Gmail
- Infinite loading on "users" after upgrade HOT 3
- Admin Log Search Issue HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from teampass.