Skip to main content

Manage the password vault in CMDB

Updated

Overview

The Password Vault stores client credentials encrypted at rest. Passwords are deliberately excluded from the search index. The vault supports check-out/check-in, rotation, breach checking, and linking credentials to the assets they belong to. The vault is client-scoped — pick a client first.

How To: Save a Password

  1. With a client selected, open Password Vault under Security in the sidebar.
  2. Click New.
  3. Enter a title, category, username, password, URL, and optional notes.
  4. Link it to a config item or asset so it appears on that record's detail page.
  5. Set a rotation policy (in days) if the credential should expire and be rotated.
  6. Save. The entry is encrypted at rest; only users with the right role can decrypt and view it.

How To: Check Out a Password

  1. Open the password entry.
  2. Click Check Out and set how long you need it.
  3. The value becomes visible and the entry is marked checked out to you.
  4. When finished, click Check In. The entry locks again and both events are recorded in the audit log.

How To: Rotate a Password

  1. Open the entry and click Rotate.
  2. Paste a new value or click Generate for a strong one.
  3. The old value is replaced, the rotation date is stamped, and the next rotation date is scheduled from the policy.
  4. If the credential is used in a live system, update it there (or tell the owner).

How To: Use a Password in an RMM Session

  1. Start a remote terminal from RMM.
  2. Click Inject Credential.
  3. Pick the password from the credentials linked to this device or its client.
  4. Confirm. The agent types the username and password into the active window. The staged credential expires after 60 seconds.

For web logins, the CMDB browser extension copies a saved password into a login form in one click. If it stops logging in, refresh your extension token from Settings → Integrations → Browser Extension; tokens expire after a set period.

Breach Checking

Saved passwords are checked against the Have-I-Been-Pwned Pwned Passwords feed. A breach flag means the password has appeared in a known public dump — rotate it immediately. It does not mean your specific account was compromised.

Security Notes

  • Clients cannot see passwords unless you explicitly share them via the portal share mechanism. By default the vault is MSP-staff only.
  • THEO will never reveal a CMDB password. Vault contents are categorically hard-blocked from the AI assistant.
  • Viewers can see metadata but cannot decrypt values; every view, edit, delete, and check-out is audited.

Troubleshooting

I can't see a password I created. Confirm your role — viewers see metadata only. An admin can check the audit log to see whether your view was blocked.

Checkout says "already checked out." Someone else has it. Open the entry, use the audit log to see who, and coordinate or have an admin force a check-in.

HIBP shows a password as breached. Rotate it now; the value is in a public dump.

Related