Setting up the password vault

Every site has a password vault of its own. It holds credentials such as the Miniserver passwords, the gateway’s remote maintenance password or customer logins for routers and cameras. With the vault’s key the gateway encrypts the backups and the server the project files. Without a vault there are neither; the system status reports this as an error every day.

The server stores the vault only in encrypted form. Decryption happens exclusively in your browser, with a master password that never leaves the browser. Even someone who gets hold of the server’s database cannot read the entries.

Setting up

A new site gets its vault when it is created. For an existing site without a vault, marked No vault in the list:

1. System Administration → Sites, at the desired site Set up password vault. Only an Owner may do this.

2. Set a Master password and repeat it. The indicator below says how hard it is to guess; passwords that are too weak are not accepted. Generate random password generates a secure password made of several words.

3. Confirm. Your browser generates the vault’s keys and sends only their encrypted form to the server.

4. Secure the Recovery code: Print emergency sheet or copy it, tick Recovery code stored safely and click Done.

5. Pass the master password on to everyone who should open the vault.

Recovery code and emergency sheet

The recovery code opens the vault if the master password is lost. It consists of 25 characters in five blocks and is shown only once. Your browser generates it; the server never sees it and cannot recover it.

The emergency sheet is a print page with site, date, code and a QR code that contains only the code. Keep it in a safe place. Whoever has it can read all backups, project files and passwords of the site.

Master password and recovery code lost

The server knows neither and cannot reset anything. If the master password and the code are lost, the entries are lost, and with them the site’s backups and stored project files.

A vault from before the recovery code has none; the system status warns about this every day until a code has been created under Maintenance.

Forgot master password

1. Open Manage password vault and click Forgot master password? below the master password. Only an Owner may do this.

2. Enter the Recovery code, in upper or lower case, with or without hyphens.

3. Set a new master password and repeat it, then Recover.

4. Secure the new code as during setup. The old one is no longer valid.

With the vault the server also stores the site’s project files, encrypted. After setup it requests the current project file of every Miniserver from the gateway again.

In a licence tier without the password vault feature the vault can be set up as well, but then only serves to encrypt the project files. It does not store passwords of Miniservers and gateways or custom entries, and under Maintenance only deleting remains. After switching to a tier with the vault, the passwords are added without setting it up again.

Managing

For a site with a vault, the same table offers Manage password vault:

• Set a new master password – for this you need the current master password. Afterwards pass the new one on to everyone authorised. The recovery code stays valid.
• Recovery code → Create new (tab Maintenance) – create a new code with the master password; the old one is then no longer valid. Useful when the emergency sheet is lost or someone who knew it leaves the team.
• Request passwords again – the gateway transfers the Miniserver passwords and the remote maintenance password again, see Transfer from the gateway.
• Delete password vault ... – removes the vault with all its entries permanently. Together with it the server deletes the encrypted project files and backups; the confirmation names how many. The current project file comes back from the gateway with a new vault, custom project files do not.

A new master password does not undo the fact that someone has already seen a password. When an employee leaves the team, change the passwords they knew directly on the devices.