AuthAnvil Password Vault Best Practice: Managing Your Password Vault Backups

Today, we’re going to take a look at the proper management of AuthAnvil Password Vault Backup files (.pvb files). Once your server is properly configured, hardened, and authenticating users, the most important part of AuthAnvil Password Vault server maintenance is making sure that you take regular backups of the AuthAnvil Password Vault Database. The AuthAnvil Password Vault includes a utility for managing backups, AAPVBackup.exe. It is a command line tool, making it easy to script or schedule using an automated task. You can find instructions on how to do so in the AuthAnvil Password Vault Install Guide.

Today’s best practice, however, is not about making backups, it’s about what you do with your backups afterwards. An AuthAnvil Password Vault pvb file stores all of your user, password, and logging information in a format that can be easily imported back into the database. Take note that pvbs also include all of your certificates and encryption keys, and the file itself is not protected in any way, so it can easily be accessed and modified.

To make sure that your backups stay uncompromised, encrypt or otherwise protect them and keep them in a safe place; somewhere that you can audit access to. Don’t forget, one backup copy is never enough, and test your restores from time to time. It’s easy to import pvbs to a test server using the AuthAnvil Password Vault installer or AAPVBackup.exe.

As always, if you have any best practices questions that you’d like to see addressed, please send them to support@scorpionsoft.com, and we’ll post the answers here.

Comments

[Dana Epp]

Great post Brent. One thing to consider is that when running AAPVBackup, you should do so from a protected directory where file auditing is enabled. This way, not only will you consider encrypting it with EFS and storing it on a encrypted disk (like maybe a Bitlocker defended partition???) you can monitor who DOES touch the file to begin with.

If anyone is interested in knowing how to do that, check out Episode 103 of Beyond the Data where we discussed File Access Auditing and how to enable it. You can watch that and other episodes at http://www.beyondthedata.tv.