VaultTub

VaultTub is a password manager managed by Bath Open Source Society which allows societies to store and share passwords securely. It can be accessed at vault.bathcs.com.

For more detailed instructions, see BitWarden’s documentation.

Quick setup

You should be messaged or told by the previous committee that you need to sign up so they can invite you. All Bath students can freely make an account (though we ask you not to store your personal passwords on there).

1. Go to vault.bathcs.com.

2. Enter your uni email and click "Use single sign-on".

3. Once redirected to our authentication site (Authelia), enter your University username and password.

4. You will be redirected back to VaultTub and asked to create a master password. Use a brand new password that you will not forget.

   If you lose the master password you will lose all access to VaultTub.

5. You may also receive emails during this process, if the email is in junk, there should be a dropdown at the top of the email with the option to make “vault@bathcs.com” never go to your junk folder. Please select this as you will get a lot more emails after this point.

6. Required: Set up 2FA

7. Required for Owners of organisations: set up emergency access

Outgoing committees/initiatives will add you to the relevant organisation as described in the handover procedure. Please ensure that they do this, otherwise you will lose all access to the society's passwords.

Recommended Settings

Once you have signed up with a password you can remember (but don’t use anywhere else), we recommend updating the following settings:

Settings can be found: “Profile Icon in top right > account settings”.

Two-step login

Two-factor authentication is mandatory for everyone.

Go to Two-step login settings and choose a provider. For the best security we recommend Authenticator app or Passkey.

Emergency access

Emergency access is mandatory for all Owners of organisations.

We recommend setting up emergency access with at least 1 other person, this is for safety if you lose access to your account.

First, ask your trusted contact to create a VaultTub account. Once they have done that, head to Emergency access settings and click “Add emergency contact”. Enter the user's email and ask them to follow the instructions they receive via email. Once all the steps are complete, go back to the Emergency access tab and verify that they show up as expected.

Make sure you verify that the user was added completely. It is easy to accidentally forget a step.

Emergency access is required for users with a significant amount of power due to the risk of losing everything (we cannot recover your passwords).

Using the extension/app

Bitwarden has a browser extension and an app which support self-hosted instances (and multiple accounts).

If you wish, you can also set it up so you can approve sign-in requests when signing in somewhere else, which you may prefer over TOTP 2FA.

To install the app or the extension:

• Download the extension, from Bitwarden’s download page
• Open it up
  • if you already have an account you can click the profile icon and then click “Add account”.
• Under the input for the email address (set to “bitwarden” by default), you can select “self-hosted”.
• Input “https://vault.bathcs.com” for the server field and hit “Save” in the top right.
• Enter your login details for VaultTub.

Recommended settings

You may wish to change the default lockout period or add a pin, which can be done in the “Settings tab”. These are handled on a per account basis.

You can click “unlock with pin” and enter a pin (unchecking “unlock with master on browser restart” if you don’t want that).

You can also change the “Vault timeout”, however this is not recommended.

Adding a Login

You can easily add a login by clicking the "New" button within the app, and filling out the details, along with the "website". Please make sure the owner is set to the society this login should live under, as well as a collection set.

From this interface you can also generate a password to fill in. The recommneded settings are:

• >= 25 characters
• include special characters
• min numbers: 2
• min special characters: 2

Organisation owners

Make sure you have at least two owners to an organisation. This is to make sure we don’t lose access to the data.

For societies we recommend roles equivalent to chair and secretary. For other initiatives, we recommend you choose two people to act as the Owner.

For security reasons, please do not grant access to external users unless necessary. Make sure to keep data secure, especially where sensitive or personal data is involved.

Owners also require emergency access to be set up with someone who is not another owner of their organisation.

Organisations

To create an organisation, you can go to your “vaults” and click the “New organization” button on the side panel.

Once created you can go to the “Organizations” tab in the top right and choose the organisation to manage, where you can invite new members (via “Members > Invite Member”) or create a new collection (basically a folder which you can choose who has access to it).

For each member you can choose the role and what collections they have permission to access, the rest is up to you on how you organise everything.

When adding members, they will have to accept the invitation and then you will have to confirm them in the organisation interface.

Handover procedures

This article is a stub.
Please help improve it by adding more detail, providing tips, and linking to other relevant pages.

We need some instructions here on how to do handover. See the old instructions in the meantime.

Rotating passwords

As part of the handover procedures, it is recommended that each initiative rotates all the passwords stored in the organisation.

To do this, please follow these rough instructions:

• Open the item on VaultTub (either by the extension or website)

• Copy the password and temporarily store it somewhere (e.g. in the notes section)

• Visit the website

• Navigate to the change password section (it’s different for every website)

• On the extension, click “edit” on the item and click the “Generate Password” button and confirm that it will override the current stored password. For password security recommendations see Passwords, in general, make passwords long and random (or use passphrases). Password managers are designed to make it easy to use such random passwords.

• Click “Save” on the item to save the new password

• Paste the new password in the change password fields + change the password

• Log out and log in again to make sure the new password has saved correctly

• Delete the temporary storage of the old password

• Add a line to the notes saying it was updated on the current date and include your name

How to deal with the worst case scenarios

If it is relating to the website being down, please contact su-boss@bath.ac.uk (CC pcs47@bath.ac.uk if urgent). Note that BOSS do not have any access to any of the data stored as it is all encrypted.

I lost my password and don’t have Emergency Access

In that case, there is nothing you can do. Your account must be deleted and you will need to be re-invited (this means you WILL lose access to any passwords you have stored outside of organisations). Organisations passwords can be recovered by other members of the organisation.

This is why you MUST either know your password by hand or store your password in your own password manager which also has a proper recovery procedure.

The owner of the organisation is not responding

If all owners of the organisation are not responding or have lost access to their account, this is slightly more of an issue so make sure to have multiple owners.

The organisation will have to be deleted and recreated. To save as many passwords as possible, get all other members to see what Collections they have access to and if they have permission to export the vault (found in the settings for the organisation).

You want to then either export the vault data or copy every single password into a new organisation.

Creating new organisations

All student groups (including non-SU groups) are welcome to have organisations to share passwords as we believe in good password policies. However, only BOSS committee can create a new organisation for you, and so please submit a request by emailing su-boss@bath.ac.uk.

They can do this through the admin interface in the "Organisation" tab (however this interface is normally turned off and so has to be activated through a redeployment).

Technical details

Backups

Backups are handled by BOSS and is one of the few systems that get a complete off-site backup on a third-party service along with the typical whole cluster backups.

But the basic idea:

• VaultTub get's backed up every 4 hours to our backup server.
• The whole cluster get's backed up every day to our backup server
• The specific VaultTub data (including passwords), gets backed up to Scaleway every day

Contact su-boss@bath.ac.uk if you have any questions. You can also see our configuration within terraform.

Emails

Emails are sent through the BOSS SMTP server. If you find they are going to junk, please contact su-boss@bath.ac.uk.