Introduction: The Enterprise Password Dilemma

In the modern corporate landscape, managing credentials securely is one of the most critical challenges facing IT departments. With teams collaborating across various platforms, sharing passwords via unencrypted channels like chat applications or spreadsheets is a recipe for a catastrophic data breach. Businesses need a centralized, secure, and collaborative solution. While commercial cloud-based password managers exist, they often introduce third-party risks and compliance headaches.

This is where Passbolt comes into play. Passbolt is an open-source, enterprise-grade password manager designed specifically for teams. By utilizing robust GPG (GNU Privacy Guard) encryption and allowing self-hosted deployment on a Virtual Private Server (VPS), Passbolt gives organizations complete ownership of their data without sacrificing usability. This comprehensive guide will walk you through the architecture, benefits, and step-by-step process of building your own enterprise password management system using Passbolt on a VPS.

Why Choose Passbolt and GPG Encryption?

Before diving into the technical setup, it is essential to understand why the combination of Passbolt and GPG stands out in the crowded market of credential managers.

1. True End-to-End Encryption (E2EE)

Passbolt is built on a strict Zero-Knowledge architecture. This means that the server hosting the application never sees the master passwords or the decrypted secrets. Encryption and decryption happen entirely on the user's client-side device using GPG keys. Even if an attacker gains root access to your VPS, they will only find encrypted blobs of data that are useless without the corresponding private keys.

2. Open Source and Auditable

Security through obscurity is a flawed philosophy. Passbolt’s source code is entirely open-source, meaning it is regularly audited by independent security firms and vetted by a global community of experts. This transparency guarantees there are no hidden backdoors.

3. Granular Access Control for Teams

Unlike personal password managers adapted for business use, Passbolt was engineered for collaboration from day one. It allows administrators to define rights at a granular level, sharing specific credentials or folders with designated teams or individuals while maintaining a strict audit log of who accessed what.

---

Prerequisites and System Requirements

To successfully deploy Passbolt on your own infrastructure, ensure you have the following components ready:

A Reliable VPS: A virtual private server running a clean installation of Ubuntu 22.04 LTS or Ubuntu 24.04 LTS. For small to medium teams, 2 vCPUs, 2GB RAM, and 20GB SSD storage are sufficient.
A Fully Qualified Domain Name (FQDN): A domain or subdomain (e.g., passwords.yourcompany.com) pointed to your VPS IP address via an A record.
An SMTP Server: Passbolt relies heavily on email notifications for user registration, key distribution, and account recovery. You will need SMTP credentials from a provider like SendGrid, Mailgun, or your internal corporate mail server.
Basic Linux Skills: Familiarity with SSH, command-line operations, and basic networking configurations.

---

Step-by-Step Deployment Guide

Step 1: Preparing the VPS Environment

First, log into your VPS via SSH and update the system packages to ensure all security patches are applied:

sudo apt update && sudo apt upgrade -y

Next, configure a basic firewall using UFW to secure your server, allowing only essential traffic:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Step 2: Installing Passbolt via the Official Script

Passbolt provides a well-maintained automated installation script that configures the entire stack, including the Nginx web server, PHP, Let's Encrypt SSL certificates, and the MariaDB database. This is the recommended approach for enterprise environments as it ensures optimal configuration and easier updates.

Download and execute the official Passbolt installation script:

wget -O passbolt-ce-installer.php [https://download.passbolt.com/ce/installer/passbolt-ce-installer.php](https://download.passbolt.com/ce/installer/passbolt-ce-installer.php)
sudo bash -c "$(curl -sSL [https://download.passbolt.com/ce/installer/install.sh](https://download.passbolt.com/ce/installer/install.sh))"

During the execution, the interactive installer will prompt you with several questions:

Database Configuration: Choose to install MariaDB locally. The script will automatically generate secure database credentials.
Domain Name: Enter your FQDN (e.g., passwords.yourcompany.com).
SSL Configuration: Select Let's Encrypt to automatically issue and manage a free, automated, and secure SSL/TLS certificate.

Note: Ensure your domain's DNS settings have propagated before requesting the Let's Encrypt certificate, otherwise the verification process will fail.

Step 3: Configuring the SMTP Mail Server

Once the core packages are installed, the setup wizard will transition to a web-based interface or guide you to complete the configuration file. You must input your SMTP details accurately within the /etc/passbolt/passbolt.php configuration file or the web UI. Without a functional mail server, users cannot be invited to the platform, and GPG keys cannot be initialized safely.

Step 4: Initializing the Administrator Account and GPG Keys

After the installation script finishes successfully, it will output a unique registration URL. Paste this URL into your web browser to finalize the setup via the Passbolt Web Installer.

During this phase, the browser extension will generate a GPG Key Pair unique to your administrator account. You will be prompted to:

Create a strong, memorable Master Password.
Download your Private GPG Key backup file (keep this extremely safe; if lost, recovery is impossible).
Select an avatar and an anti-phishing security token.

---

Post-Installation Best Practices for Enterprises

Deploying the software is only the first step. To ensure an enterprise-grade security posture, you must implement strict operational habits:

1. Regular Backups are Mandatory

Because of the asymmetric encryption, a failure in your database or server infrastructure without a backup means permanent data loss. Implement an automated daily backup routine that captures three vital elements:

The MariaDB database dump.
The Passbolt configuration files located in /etc/passbolt/.
The server's GPG public keys.

Store these backups in a secure, off-site, encrypted location separate from your VPS provider.

2. Enforce Browser Extension Security

Passbolt operates primarily through browser extensions (Chrome, Firefox, Edge, Brave) and mobile apps. Instruct your staff to lock their browser extensions when leaving their workstations and prohibit the sharing of master passwords under any circumstance.

3. Monitor Server Logs

Regularly inspect Nginx access logs and Passbolt audit logs to track any unauthorized attempts to access the server or anomalous credential sharing activities.

Conclusion

Building a self-hosted Enterprise Password Manager using Passbolt and GPG encryption on a VPS balances maximum security with full administrative control. It eliminates reliance on external cloud vendors, guarantees compliance with strict data sovereignty regulations, and provides teams with a frictionless, highly secure collaborative environment. By following this guide and establishing rigorous backup policies, your organization can operate with peace of mind, knowing your digital keys are protected by mathematically proven encryption.

Building a Secure Enterprise Password Management System with Passbolt and GPG Encryption on a VPS