Managing passwords in a professional environment is often a real headache. Even though we all know security is vital, it's sadly common to find files called "passwords.txt" forgotten in shared folders or, even worse, in Excel spreadsheets that anyone can open. To bring order to this chaos, Passbolt emerges as a robust alternative , designed specifically for those who don't want to leave their secrets to chance.
Unlike other tools, this open-source password manager was created in Europe with technical teams and agencies that take cybersecurity seriously in mind. It's not simply a repository for storing keys, but a collaborative platform based on OpenPGP , which guarantees that the server never has access to the keys in plaintext, offering true, auditable, end-to-end encryption.
What makes Passbolt a superior choice for teams?
Passbolt isn't designed for individual users who just want to save their Netflix password; it focuses on secure collaboration among workgroups . It allows you to share credentials for routers, office Wi-Fi networks, or corporate social media accounts without having to send them through insecure channels like chat or email. Its architecture ensures robust security, undergoing constant penetration testing to prevent vulnerabilities.
Furthermore, its integration capabilities are remarkable, allowing it to connect with tools like Remote Desktop Manager, making it easy for system administrators to view their password directories seamlessly. Being open source and self-hostable , it gives companies complete control over their data, avoiding reliance on cloud services where it's unclear who actually controls the server.
Detailed guide for installation on a Linux server (Debian/Ubuntu)
To get Passbolt up and running in a local environment with Debian or Ubuntu, the first step is to prepare the system. It's essential to update all packages and load the basic system dependencies to avoid conflicts during installation.
1. Preparation of the environment and basic services
The first step involves installing and configuring the Nginx web server and the MariaDB database management system. After installing Nginx, the MariaDB instance must be secured by running the security script to remove anonymous users and test databases. Subsequently, a specific database and a user with limited permissions are created; this user will be used by the application to operate.
Regarding the programming language, Passbolt requires PHP 8.2 along with the necessary modules for encryption and database connection. It is vital to verify that the installed version is correct before proceeding to the next step.
2. Passbolt Deployment and Initial Configuration
To install the application, it is best to use the Passbolt official repositoryThis is achieved by downloading the configuration script from the repository, verifying its integrity using a SHA512 checksum to avoid corrupt or malicious files, and running the package installation. passbolt-ce-server.
Once the software is installed, an interactive setup wizard will launch . This process is crucial and will request information such as the server URL, the previously created database credentials, and the SMTP server configuration. Email is essential , as Passbolt uses it to manage invitations and notifications; you can choose a local server like Postfix or external services such as Gmail or SendGrid.
3. Security, SSL and GPG Keys
For the installation to be viable in production, configuring HTTPS is mandatory. It is recommended to use Certbot to obtain free SSL certificates from Let's Encrypt and schedule their automatic renewal. Without SSL encryption, data would travel in plain text across the network, negating much of the system's security.
A key technical point is generating the server's GPG key . This key allows the Passbolt API to authenticate correctly. It's important to generate this key without a passphrase, as the PHP module used doesn't support it at this stage.
Quick alternative: Deployment using Docker
For those who prefer not to deal with manually installing dependencies, Passbolt can be set up in minutes using Docker Compose . This method is ideal for testing environments or for those who already manage their services in containers.
Using a YAML file, two services are defined: one for the MariaDB database and another for the Passbolt application. It is imperative to change all default passwords and adjust the base URL before launching the container. This approach greatly simplifies backups and migration between servers, as the entire environment is encapsulated in standard images.
User Configuration and Recovery Kit
After completing the technical setup, the administrator must create their first account. At this point, the browser will prompt the installation of the Passbolt browser extension , which is the actual tool where the encryption and decryption of the keys takes place.
The most critical step in the entire process is downloading the recovery kit . Because end-to-end encryption is used, if access to the private key is lost or the user password is forgotten, there is no way to recover the data. Storing this kit in a safe place is the only guarantee against losing all stored passwords in case of hardware failure or browser loss.
Finally, a custom security token (one color and three characters) is established that serves as an anti-phishing measure, forcing the user to enter it before performing any sensitive action within the platform.
We have an extremely powerful tool that allows you to centralize a company's security without compromising privacy. Whether through a comprehensive Debian installation or the agility of Docker, the key is to prioritize self-hosting and OpenPGP encryption to prevent corporate credentials from falling into the wrong hands due to mismanagement or a cloud security breach.
