Gestionar las claves de acceso en un entorno profesional suele ser un auténtico quebradero de cabeza. A pesar de que todos sabemos que la seguridad es vital, es tristemente común encontrar archivos llamados «passwords.txt» olvidados en carpetas compartidas o, peor aún, hojas de Excel que cualquiera puede abrir. Para poner orden en este caos, Passbolt emerges as a robust alternative and designed specifically for those who don't want to leave their secrets to chance.
Unlike other tools, this open-source password manager was created in Europe with technical teams and agencies that take cybersecurity seriously in mind. It's not simply a repository for storing keys, but a collaborative platform based on OpenPGPThis ensures that the server never has access to the plaintext keys, providing real and auditable end-to-end encryption.
What makes Passbolt a superior choice for teams?
Passbolt is not intended for the individual user who just wants to save their Netflix password, but rather focuses on the secure collaboration between work groupsIt allows you to share credentials for routers, office Wi-Fi networks, or corporate social media accounts without having to send them through insecure channels like chat or email. Its architecture ensures robust security, adhering to constant penetration testing to avoid vulnerabilities.
Furthermore, its integration capabilities are remarkable, allowing it to connect with tools like Remote Desktop Manager, making it easy for system administrators to view their password directories seamlessly. open source and self-hostableCompanies maintain full control over their data, avoiding dependence on cloud services where it is unknown who actually controls the server.
Detailed guide for installation on a Linux server (Debian/Ubuntu)
To set up Passbolt in a local environment with Debian or Ubuntu, the first step is to prepare the system. This is essential. update all packages and load the basic system dependencies to avoid conflicts during installation.
1. Preparation of the environment and basic services
The first step is to install and configure the Nginx web server and the MariaDB database manager. After installing Nginx, you should secure the MariaDB instance The security script is then executed to remove anonymous users and test databases. Subsequently, a specific database and a user with limited permissions are created, which the application will use to operate.
Regarding the programming language, Passbolt requires PHP 8.2 along with its modules These are necessary for the encryption to function and for the database connection to work. It is vital to verify that the installed version is correct before proceeding to the next step.
2. Passbolt Deployment and Initial Configuration
To install the application, it is best to use the Passbolt official repositoryThis is achieved by downloading the configuration script from the repository, verifying its integrity using a SHA512 checksum to avoid corrupt or malicious files, and running the package installation. passbolt-ce-server.
Once the software is installed, a interactive setup wizardThis process is crucial and will request data such as the server URL, the previously created database credentials, and the SMTP server configuration. Email is essentialSince Passbolt uses it to manage invitations and notifications, you can choose a local server like Postfix or external services like Gmail or SendGrid.
3. Security, SSL and GPG Keys
For the installation to be viable in production, configuring HTTPS is mandatory. It is recommended to use Certbot to obtain free SSL certificates de Let’s Encrypt y programar su renovación automática. Sin cifrado SSL, los datos viajarían en texto plano por la red, anulando gran parte de la seguridad del sistema.
A key technical point is the generating the server's GPG keyThis key allows the Passbolt API to authenticate correctly. It is important to generate this key without a passphrase, as the PHP module used does not support it at this specific step.
Quick alternative: Deployment using Docker
For those who prefer not to deal with manually installing dependencies, Passbolt can be set up in minutes using Docker ComposeThis approach is ideal for testing environments or for those who already manage their services in containers.
Using a YAML file, two services are defined: one for the MariaDB database and another for the Passbolt application. This is imperative. Change all default passwords and adjust the base URL before launching the container. This approach greatly simplifies backups and migration between servers, as the entire environment is encapsulated in standard images.
User Configuration and Recovery Kit
After completing the technical part, the administrator must create their first account. At this point, the browser will request the Passbolt browser extension installation, which is the actual tool where the encryption and decryption of the keys takes place.
The most critical step in the entire process is the recovery kit downloadWhen using end-to-end encryption, if access to the private key is lost or the user's password is forgotten, there is no way to recover the data. Store this kit in a safe place. It is the only guarantee of not losing all stored passwords in case of hardware failure or browser loss.
Finally, a custom security token (one color and three characters) which serves as an anti-phishing measure, forcing the user to enter it before performing any sensitive action within the platform.
We have an extremely powerful tool that allows you to centralize a company's security without relinquishing privacy to third parties. Whether through a comprehensive Debian installation or the agility of Docker, the key is to prioritize the self-hosting and OpenPGP encryption to prevent corporate credentials from ending up in the wrong hands due to mismanagement or a cloud security breach.
