The credentials vault

A credential holds the secrets for one thing a customer uses. Most are logins (a username, password, two-factor secret, licence key, web address and notes), but a credential can also be an SSH key, a Certificate, an API key, a Secure note or a Secret file. It belongs to one customer and, optionally, one site, and can be linked to devices so the login is there when someone works on them. Your own company's logins live in the same vault under Our company.

The other kinds, check-out with approval, one-time links and your own company's credentials are covered in Check-out, one-time links and secret types.

How secrets are protected#

• Encrypted one by one. Each secret has its own random key and is encrypted with AES-256-GCM. The encryption is tied to the credential and field it belongs to, so a secret copied onto another credential will not open.
• Never in lists or search. Secrets are not in any list, search result or the activity log. Search finds credentials by name, username and address only.
• Revealing needs its own permission. Seeing a credential in a list is not the same as reading its secret. Revealing or copying a secret needs the role action Reveal credentials, and Tenvara asks you to confirm it is you before it shows one.
• Every look is logged. Revealing, copying, downloading and showing a two-factor code are each recorded in the vault audit log with the person, the field, their address and browser.
• Earlier values are kept. When a secret changes, the value it replaces is kept encrypted: the last ten of each.
• Rate limited. Reveals, copies and two-factor codes together are limited to 30 a minute per person, so a script cannot empty the vault quickly.
• Two-factor secrets stay on the server. Tenvara works out the current code on the server, so the secret itself never reaches the browser.

The Credentials list#

Open Docs and choose Credentials under Passwords.

Each row shows the credential's name and username, the Customer, its Kind, what it Holds (the icons show a password, two-factor code and so on) and when a change is due. Columns chooses what else to show. Credentials for administrators only carry an Administrators only badge, and ones that need an approved check-out say Needs approval.

On a row, press P to copy the password and T to copy the two-factor code without opening it. Filter by Customer, Kind, what it Holds, Change due, Tags, or Breach check to find passwords that appear in known breaches. Every vault password, for every customer, is checked against known breached passwords. The Found in breaches view lists them (see Dark web monitoring), and Due for a change lists the ones whose password change is due or overdue.

Tick several rows to Change site, switch Administrators only on or off, Move to another customer (the passwords, their history and the audit trail move with them), Archive, Delete or change tags in one go.

Adding a credential#

1. Press New credential on the Credentials list, a customer's Docs tab, or Add credential on a device.
2. Choose A customer and the customer (or Our company for your own), then under What are you adding? choose Login. Enter a Name that says what it is for, for example "Firewall admin" or "Xero login".
3. Enter the Username and, if it is for one site, choose the Site.
4. Enter the Password, or press Generate to make one (below).
5. Enter the Web address where you sign in.
6. For a Two-factor secret, paste the otpauth:// link from the QR code, or the key itself.
7. Enter a Licence key if there is one.
8. Under Devices, press Link devices to show the credential on those devices.
9. Add Tags and Notes if useful.
10. Optionally choose an Owner (the person reminded when a change is due) and how often it should be changed.
11. Tick Administrators only for break-glass accounts (below), or Requires approval to reveal if people must ask first.
12. Press Add credential, or Cmd+Enter.

The password generator#

Press Generate beside the password to open the generator.

1. Set the Length with the slider (up to 128 characters).
2. Choose the character sets: A to Z, a to z, 0 to 9 and symbols.
3. Tick Easy to read out (no 0 O 1 l I) for a password you will read over the phone.
4. Press the refresh icon for another, then Use this password.

The password is made in your browser and only goes to the server when you save.

Administrators only#

Tick Administrators only for accounts such as a domain administrator or a global admin kept for emergencies. Nobody else sees the credential at all: not in lists, search or on devices. Its audit entries are visible to administrators only too.

Using a credential#

Click a credential to open it.

• Open the address in a new tab with the button at the top.
• Copy password copies it without showing it (P).
• The eye icon beside a secret reveals it; the copy icon copies it.
• Two-factor shows a Show code button. The current code appears with a countdown, and the next one is fetched when it runs out.
• Changing it shows how often the password should change, when it last did and whether it is due.
• Password history lists the earlier values, each with who set it and when it was replaced, to reveal or Put back.
• One-time links lists links that send this secret to someone, with Share securely to make one.
• Related lists the records and articles related to it.

Keyboard shortcuts#

The same actions are in Cmd+K while a credential is open.

Who has seen it#

The Who has seen it table lists every reveal, copy, two-factor code and change for this credential, with who, what, which field and from which address. Fills by the browser extension, passwords typed into a remote session, rotations and break-glass exports are listed here too. A reveal made from a ticket says so: the ticket's Credentials block reveals with the ticket as the reason, and the log shows what the person was working on. Whole audit log opens the full vault log. See Reviews and the vault audit log.

Devices and Used by#

• Devices lists the devices the credential shows on. Press Link devices to add more.
• Used by lists records that link to this credential, for example the network record whose firewall login it is.

More actions#

The ... menu has Copy username, Share securely, Archive and Delete credential. Deleting a credential puts it in the recycle bin with its history and keeps its audit entries.

Credentials on devices#

A linked credential appears in the device's Documentation section with its username and masked secrets, and reveal and copy buttons beside each. This is usually the quickest way for a technician to get a login while working on a machine.

Tip: Link a server's local administrator or backup console login to the server itself. Whoever picks up an alert for it then has the login on the same page.

BitLocker recovery keys#

On Windows devices with the agent, Tenvara collects the recovery key of every BitLocker-encrypted volume into the vault, however BitLocker was switched on. Each key is a credential for the device's customer, named after the volume and the device (for example "BitLocker recovery key C: (HVD-LT-001)"), so it is found in Docs > Credentials, in search and on the device. Keys are checked daily and when they change, and a key that has been replaced is kept and marked as replaced.

Revealing a recovery key works like any other secret: it needs Reveal credentials, you confirm it is you, and the reveal is in the vault audit log. See BitLocker recovery keys.

Changing a password#

1. Open the credential and press Edit (or E).
2. Enter the new password or generate one.
3. Save.

Password changed in the header shows when the password was last set, and the change is written to the audit log as Set.

You can also have Tenvara change passwords for you. Local administrator passwords and privileged Active Directory accounts can be rotated on a schedule, with each new password kept in the vault; see Password rotation and privileged access.

More ways to use the vault#

• In the browser. The browser extension fills usernames, passwords and two-factor codes into websites and saves new sign-ins. See The browser extension.
• In a remote session. The remote viewer can type a credential into a sign-in box on the device without you seeing it. See Password rotation and privileged access.
• When Tenvara is down. A break-glass export keeps an encrypted copy of the vault that opens offline. See Vault break-glass export.