VaultTub - Revision history

Pcs47: /* Rotating passwords */ Add link to passwords page and TL;DR it here.

2026-06-11T22:38:01Z

Rotating passwords: Add link to passwords page and TL;DR it here.

← Older revision		Revision as of 22:38, 11 June 2026
Line 112:		Line 112:
	As part of the handover procedures, it is recommended that each initiative rotates all the passwords stored in the organisation.		As part of the handover procedures, it is recommended that each initiative rotates all the passwords stored in the organisation.

	To do this, please follow ~~this~~ rough ~~instruction list~~:		To do this, please follow these rough instructions:

	<ul>		<ul>
Line 119:		Line 119:
	<li><p>Visit the website</p></li>		<li><p>Visit the website</p></li>
	<li><p>Navigate to the change password section (it’s different for every website)</p></li>		<li><p>Navigate to the change password section (it’s different for every website)</p></li>
	<li><p>On the extension, click “edit” on the item and click the “Generate Password” button and confirm that it will override the current password ~~stored then</p>~~		<li><p>On the extension, click “edit” on the item and click the “Generate Password” button and confirm that it will override the current stored password. For password security recommendations see [[Passwords]], in general, make passwords long and random (or use passphrases). Password managers are designed to make it easy to use such random passwords.</p>
	~~<p>~~Password ~~recommendations:~~</p>
	~~<ul>~~
	~~<li>>= 25 characters</li>~~
	~~<li>include special characters</li>~~
	~~<li>min numbers: 2</li>~~
	~~<li>min special characters: 2</li>~~
	~~<li>uncheck “avoid ambiguous characters”</li></ul></li~~>
	<li><p>Click “Save” on the item to save the new password</p></li>		<li><p>Click “Save” on the item to save the new password</p></li>
	<li><p>Paste the new password in the change password fields + change the password</p></li>		<li><p>Paste the new password in the change password fields + change the password</p></li>

Pcs47: /* How to deal with the worst case scenarios */ Add CC to me if urgent.

2026-06-11T22:32:32Z

How to deal with the worst case scenarios: Add CC to me if urgent.

← Older revision		Revision as of 22:32, 11 June 2026
Line 135:		Line 135:
	== How to deal with the worst case scenarios ==		== How to deal with the worst case scenarios ==

	If it is relating to the website being down, please contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk]. Note that BOSS do not have any access to any of the data stored as it is all encrypted.		If it is relating to the website being down, please contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk] (CC [mailto:pcs47@bath.ac.uk pcs47@bath.ac.uk] if urgent). Note that BOSS do not have any access to any of the data stored as it is all encrypted.

	=== I lost my password and don’t have Emergency Access ===		=== I lost my password and don’t have Emergency Access ===

Pm2022 at 17:50, 11 June 2026

2026-06-11T17:50:32Z

Show changes

Hw2210: Update to be more accurate to the current system

2026-06-04T07:30:26Z

Update to be more accurate to the current system

← Older revision		Revision as of 07:30, 4 June 2026
Line 1:		Line 1:
	VaultTub is our self-hosted vaultwarden/bitwarden instance which can be accessed via [https://vault.bathcs.com vault.bathcs.com].		VaultTub is our self-hosted vaultwarden/bitwarden instance managed by [[Bath Open Source Society\|BOSS]] which can be accessed via [https://vault.bathcs.com vault.bathcs.com]. This allows societies to store and share passwords freely amongst themselves.

	During handover, you ~~should~~ be ~~invited~~ to ~~sign up from vault@bathcs.com (it might be in~~ the ~~junk folder)~~.		During handover, you may be messaged to create an account and join the societies organisation on thep platform.

	For docs of how to use this, see [https://bitwarden.com/help/ bitwarden’s documentation].		For docs of how to use this, see [https://bitwarden.com/help/ bitwarden’s documentation].
Line 11:		Line 11:
	}}		}}

	~~BathCS admins will~~ invite you ~~to VaultTub once you’ve been elected~~. ~~Hopefully you will get~~ an ~~email from them directing~~ you ~~here~~.		You should be message or told by the previous committee that you need to signup so they can invite you. All bath students can freely make an account (though we ask you not to store your personal passwords on there).

	<ol style="list-style-type: decimal;">		<ol style="list-style-type: decimal;">
	<li><p>~~Once invited, go~~ to ~~the junk folder in Outlook and find the email~~</p></li>		<li><p>Go to [https://vault.bathcs.com vault.bathcs.com]</p></li>
	<li><p>~~If the~~ email is in '''junk''', there should be a dropdown at the top of the email with the option to make “vault@bathcs.com” never go to your junk folder. Please select this as you will get a lot more emails after this point.</p></li>		<li><p>Enter your uni email and click "Use single sign-on"</p></li>
	<li><p>~~Follow the link in the email~~ to ~~sign up~~</p></li>		<li><p>Once redirected to our authentication site, enter your university username and password.</p></li>
	<li><p>~~Enter your details~~ and create ~~an account:~~</p>		<li><p>You will be redirected back and asked to create a master password</p>{{Note\|text=If you lose the password you will not be able to recover it\|type=warn}}</li>
	<ul>		<li><p>You may also receive emails during this process, if the email is in '''junk''', there should be a dropdown at the top of the email with the option to make “vault@bathcs.com” never go to your junk folder. Please select this as you will get a lot more emails after this point.</p></li>
	<li>~~Use your University of Bath email (as it’s by invite only)</li>~~
	<li>~~Make sure~~ the ~~password~~ is ~~strong (and~~ '''~~isn’t~~''' ~~used anywhere else) and you can remember it~~. ~~Write it down somewhere safe if you are unsure~~.~~</li></ul>~~

	~~{{Note\|type=warn\|text=~~
	~~<p>If~~ you ~~lose~~ this ~~password, you cannot recover it~~.</p>
	}}</li>
	<li><p>'''REQUIRED''': [[#Two-step login\|Set up 2FA]]</p></li>		<li><p>'''REQUIRED''': [[#Two-step login\|Set up 2FA]]</p></li>
	<li><p>'''OPTIONAL''': [[#Keys\|Follow security recommendations]]</p></li>		<li><p>'''OPTIONAL''': [[#Keys\|Follow security recommendations]]</p></li>
Line 61:		Line 55:
	=== Emergency Access ===		=== Emergency Access ===

	{{Note~~\|type~~\|text=		{{Note\|text=
	This is a '''requirement''' for all the [[#Quick note on owners\|Owners of organisations]]		This is a '''requirement''' for all the [[#Quick note on owners\|Owners of organisations]]
	}}		\|type=warn}}

	We recommend setting up emergency access with at least 1 other person, this is for safety if you lose access to your account.		We recommend setting up emergency access with at least 1 other person, this is for safety if you lose access to your account.
Line 97:		Line 91:

	You can also change the “Vault timeout”, however this is '''not''' recommended.		You can also change the “Vault timeout”, however this is '''not''' recommended.

			==== Adding a Login ====
			You can easily add a login by clicking the "New" button within the app, and filling out the details, along with the "website". Please make sure the owner is set to the '''society this login should live under''', as well as a collection set.

			From this interface you can also generate a password to fill in. The recommneded settings are:

			* >= 25 characters

			<li>include special characters</li>
			<li>min numbers: 2</li>
			<li>min special characters: 2</li>
			<li>uncheck “avoid ambiguous characters”</li>

	== Quick note on owners ==		== Quick note on owners ==
Line 134:		Line 140:
	== Handover procedures ==		== Handover procedures ==

	Please see [../handover/permissions.~~md]~~		Please see [https://boss.bathcs.com/handover/permissions/ our handover instructions].

	=== Rotating passwords ===		=== Rotating passwords ===
Line 179:		Line 185:
	You want to then either export the vault data or copy every single password into a new organisation.		You want to then either export the vault data or copy every single password into a new organisation.

	== ~~Instance Management stuff~~ ==		== Create an organisation for your society ==
			All societies are welcome to have organisations to share passwords as we believe in good password policies. However, only BOSS committee can create a new organisation for you, and so please submit a request by emailing [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk].

	~~=== Inviting new~~ users ~~===~~		They can do this through the [https://vault.bathcs.com/admin/users/overview admin interface] in the "Organisation" tab (however this interface is normally turned off and so has to be activated through a redeployment).

	~~Only administrators (with the interface password) can invite new users.~~		== Instance Management stuff ==

	~~This can be done through the [https://vault.bathcs.com/admin/users/overview admin interface]. You simply type the users email in “Invite User” section.~~

	=== Backups ===		=== Backups ===

	~~This is~~ handled by ~~me (hw2210) as I am the maintainer~~ of the ~~NAS it is running~~ on.		Backups are handled by [[Bath Open Source Society\|BOSS]] and is one of the few systems that get completely offsite backup on a third-party service along with the typical whole cluster backups.

	But the basic idea:		But the basic idea:

	* ~~Has an on-site iterative~~ backup every day		* VaultTub get's backed up every 4 hours to our backup server.
	* ~~Has an off-site iterative backup~~ every day		* The whole cluster get's backed up every day to our backup server
			* The specific VaultTub data (including passwords), get's backed up to [https://www.scaleway.com/en/ Scaleway] every day

	Contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk] if you have any questions.		Contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk] if you have any questions. You can also see [https://gitlab.bath.ac.uk/cs/int/terraform/ our configuration within terraform].

	=== Emails ===		=== Emails ===
Line 202:		Line 208:
	Emails are sent through my SMTP server on the same network, which cannot receive emails (because of the firewall) but can send them.		Emails are sent through my SMTP server on the same network, which cannot receive emails (because of the firewall) but can send them.

	I should mention this has dkim, dmarc and spf setup to help with bypassing spam filters. From testing this works fine however may end up in junk folders from now and again.		I should mention this has dkim, dmarc and spf setup to help with bypassing spam filters as well as being sent from a university IP (improving deliverability). From testing this works fine however may end up in junk folders from now and again.

Hw2210: Translate from boss.bathcs.com

2026-06-04T07:02:36Z

Translate from boss.bathcs.com

New page

VaultTub is our self-hosted vaultwarden/bitwarden instance which can be accessed via [https://vault.bathcs.com vault.bathcs.com].

During handover, you should be invited to sign up from vault@bathcs.com (it might be in the junk folder).

For docs of how to use this, see [https://bitwarden.com/help/ bitwarden’s documentation].

== Quick setup ==

{{Note|text=
Throughout this page we refer to “Owners of organisations”, from this we mean the delegated people who are the Owners of the Bitwarden organisation. Please see our [[#Quick note on owners|quick note on owners]] for who this should be.
}}

BathCS admins will invite you to VaultTub once you’ve been elected. Hopefully you will get an email from them directing you here.

<ol style="list-style-type: decimal;">
<li>Once invited, go to the junk folder in Outlook and find the email</li>
<li>If the email is in '''junk''', there should be a dropdown at the top of the email with the option to make “vault@bathcs.com” never go to your junk folder. Please select this as you will get a lot more emails after this point.</li>
<li>Follow the link in the email to sign up</li>
<li>Enter your details and create an account:
<ul>
<li>Use your University of Bath email (as it’s by invite only)</li>
<li>Make sure the password is strong (and '''isn’t''' used anywhere else) and you can remember it. Write it down somewhere safe if you are unsure.</li></ul>

{{Note|type=warn|text=
If you lose this password, you cannot recover it.
}}</li>
<li>'''REQUIRED''': [[#Two-step login|Set up 2FA]]</li>
<li>'''OPTIONAL''': [[#Keys|Follow security recommendations]]</li>
<li>'''REQUIRED''': '''for [[#Quick note on owners|Owners of organisations]]''': set up [[#Emergency Access|emergency access]]</li></ol>

Previous committees/initiatives will add you to the relevant organisation as described in the handover procedure.

{{Note|type=warn|text=
Please berate them with emails until they do this as (which has to happen before the summer holidays). This is because if they are uncontactable, all the passwords will be lost forever.
}}

== Recommended Settings ==

Once you have signed up with a password you can remember (but don’t use anywhere else), we recommend updating the following settings:

Settings can be found: “Profile Icon in top right > account settings”.

=== Two-step login ===

{{Note|type=warn|text=
This is required for all committee members, please see our [[2FA|2fa page here]] for a more general overview of what this is.
}}

Assuming you don’t have a security key, we recommend using the “Authenticator App” option (see [[2FA#Individuals|the instructions in 2fa section here]] for a more in-depth explanation of how to setup this).

If you have a security key (e.g. Yubikey), use the FIDO2 WebAuthn option. All other options have not been enabled as that takes time and is not worth it.

=== Keys ===

I recommend upgrading to use Argon2id with settings:

* KDF Iterations: 10
* KDF Memory: 64 (maximum that works with iOS)
* KDF Parrallelism 8

=== Emergency Access ===

{{Note|type|text=
This is a '''requirement''' for all the [[#Quick note on owners|Owners of organisations]]
}}

We recommend setting up emergency access with at least 1 other person, this is for safety if you lose access to your account.

Head to [https://vault.bathcs.com/#/settings/emergency-access the emergency access tab in the settings page] and click “Add emergency contact”, entering the users email (Note they need to have a VaultTub account).

This should be required for users with a significant amount of power due to the risk of losing everything (we cannot recover your passwords).

Note this does require about 3 emails of back and forth accepting with the person (I have been fooled into thinking it was over before when it was not).

=== Using the extension/app ===

Bitwarden has a [https://bitwarden.com/download/#downloads-web-browser browser extension] and an [https://bitwarden.com/download/#downloads-mobile app] which supports self-hosted instances (and multiple accounts).

{{Note|text=
If you wish, you can also set it up so you can approve sign-in requests when signing in somewhere else, which you may prefer over TOTP 2FA.
}}

To install the app or the extension:

* Download the extension, from [https://bitwarden.com/download/#downloads-web-browser Bitwarden’s download page]
* Open it up
** if you already have an account you can click the profile icon and then click “Add account”.
* Under the input for the email address (set to “bitwarden” by default), you can select “self-hosted”.
* Input “https://vault.bathcs.com” for the server field and hit “Save” in the top right.
* Enter your login details for VaultTub.

==== Recommended settings ====

You may wish to change the default lockout period or add a pin, which can be done in the “Settings tab”. These are handled on a '''per account''' basis.

You can click “unlock with pin” and enter a pin (unchecking “unlock with master on browser restart” if you don’t want that).

You can also change the “Vault timeout”, however this is '''not''' recommended.

== Quick note on owners ==

Make sure you have at least two owners to an organisation. This is so we have backups to make sure we don’t lose access to the data.

For societies we recommend roles equivalent to chair and secretary. For other initiatives, we recommend you choose someone to act as the Owner.

{{Note|text=
For security reasons, please do not grant access to external users unless necessary. Make sure to keep data secure, especially where sensitive or personal data is involved.
}}

Owners also require [[#Emergency Access|emergency access]] to be set up with someone who is not another owner of their organisation.

== Recommended Use ==

This should be used for society passwords.

These society passwords should be stored in relevant organisations. You have the power to create as many organisations you like and share them with other people.

{{Note|text=
When you are no longer a member of a society your account will be disabled (but not deleted unless necessary).
}}

=== Organisations ===

To create an organisation, you can go to your “vaults” and click the “New organization” button on the side panel.

Once created you can go to the “Organizations” tab in the top right and choose the organisation to manage, where you can invite new members (via “Members > Invite Member”) or create a new collection (basically a folder which you can choose who has access to it).

For each member you can choose the role and what collections they have permission to access, the rest is up to you on how you organise everything.

{{Note|text=
When adding members, they will have to accept the invitation and then you will have to confirm them in the organisation interface.
}}

== Handover procedures ==

Please see [../handover/permissions.md]

=== Rotating passwords ===

As part of the handover procedures, it is recommended that each initiative rotates all the passwords stored in the organisation.

To do this, please follow this rough instruction list:

<ul>
<li>Open the item on VaultTub (either by the extension or website)</li>
<li>Copy the password and temporarily store it somewhere (e.g. in the notes section)</li>
<li>Visit the website</li>
<li>Navigate to the change password section (it’s different for every website)</li>
<li>On the extension, click “edit” on the item and click the “Generate Password” button and confirm that it will override the current password stored then
Password recommendations:
<ul>
<li>>= 25 characters</li>
<li>include special characters</li>
<li>min numbers: 2</li>
<li>min special characters: 2</li>
<li>uncheck “avoid ambiguous characters”</li></ul></li>
<li>Click “Save” on the item to save the new password</li>
<li>Paste the new password in the change password fields + change the password</li>
<li>Log out and log in again to make sure the new password has saved correctly</li>
<li>Delete the temporary storage of the old password</li>
<li>Add a line to the notes saying it was updated on the current date and include your name</li></ul>

== How to deal with the worst case scenarios ==

If it is relating to the website being down, please contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk]. Note that I do not have any access to any of the data stored as it is all encrypted.

=== I lost my password and don’t have Emergency Access ===

In that case, there is nothing we can do. Your account must be deleted and you will need to be re-invited (this means you WILL lose access to any password you have on the account). Organisations passwords can be recovered by other members of the organisation.

This is why you MUST either know your password by hand or store your password in your own password manager which also has a proper recovery procedure (which normally have to be emergency access contacts).

=== The owner of the organisation is not responding ===

If all [[#Quick note on owners|owners of the organisation]] are not responding or have lost access to their account, this is slightly more of an issue so make sure to have multiple owners.

The organisation will have to be deleted and recreated. To save as many passwords as possible, get all other members to see what Collections they have access to and if they have permission to export the vault (found in the settings for the organisation).

You want to then either export the vault data or copy every single password into a new organisation.

== Instance Management stuff ==

=== Inviting new users ===

Only administrators (with the interface password) can invite new users.

This can be done through the [https://vault.bathcs.com/admin/users/overview admin interface]. You simply type the users email in “Invite User” section.

=== Backups ===

This is handled by me (hw2210) as I am the maintainer of the NAS it is running on.

But the basic idea:

* Has an on-site iterative backup every day
* Has an off-site iterative backup every day

Contact [mailto:su-boss@bath.ac.uk su-boss@bath.ac.uk] if you have any questions.

=== Emails ===

Emails are sent through my SMTP server on the same network, which cannot receive emails (because of the firewall) but can send them.

I should mention this has dkim, dmarc and spf setup to help with bypassing spam filters. From testing this works fine however may end up in junk folders from now and again.