A password manager running on our own hardware, at ncsmcs.ncsmosiac.com. It works in a browser, and through the official Bitwarden apps and extensions on every platform — phone, desktop, and browser.
Read this before you install anything
The Bitwarden apps default to Bitwarden’s own servers. Ours is not Bitwarden’s. You have to point the app at our server before you log in, not after.
Skip that step and you’ll type a perfectly correct email and password, get told your credentials are invalid, and reasonably conclude something is broken. Nothing is broken. You’re knocking on the wrong door.
iPhone and iPad: open the app, and before signing in, tap the gear icon in the top-left. Choose “Self-hosted” and enter https://ncsmcs.ncsmosiac.com as the server URL.
Android: same idea — the gear or region selector on the login screen, then Self-hosted, then the same URL.
Browser extension: click the region dropdown above the email field, choose “Self-hosted,” enter the URL, save. Then log in.
Desktop app: Settings before login, same field, same URL.
Do it once per device. The app remembers.
Your master password is different from your NCS password
Depending on whether you were in the pilot group, your account was either created manually or you’ll sign in with your NCSMFA credentials. Either way, during setup you’ll be prompted to create a master password and to enroll 2FA. NCSMCS uses an embedded Cisco Duo system, so Duo is what you’ll use for that second factor here.
Nobody can reset your master password. Not us. The vault is encrypted with a key derived from that password, on your device, before anything reaches the server. What we store is a blob we cannot read. That’s the entire point — it’s what makes a self-hosted password manager worth running at all.
The consequence is blunt: forget your master password and the contents are gone. Permanently. There is no support ticket, no override, no admin button. We’d like to help and we will not be able to.
So pick something you will genuinely remember. A long passphrase of ordinary words beats a short mess of symbols, both for memorability and for actual strength. Write it down and put it somewhere physically safe if that’s what it takes — a piece of paper in a drawer at home is a perfectly respectable backup for this one specific secret.
What to actually do with it
Store your passwords in it, then stop remembering them. The point isn’t to memorize better passwords, it’s to stop memorizing them entirely. Every account gets a long random password you never see, generated by the app.
Import what you’ve got. Whatever’s saved in Chrome, Firefox, Safari, or an old password manager can be exported and pulled in through Tools → Import. Then turn off your browser’s built-in password saving, because two things half-remembering your logins is worse than either one alone.
Let it fill things in. The browser extension and the mobile apps autofill login forms. This is the part that makes people actually stick with it — if using the manager is more work than not using it, it loses.
One caution on storing two-factor codes. The vault can hold TOTP codes as well as passwords, which is convenient and also puts both locks in one box. For low-stakes accounts, fine. For your email, your bank, and anything that can reset other accounts, keep the second factor somewhere separate.
And one specific case: don’t put your NCSMFA second factor in here. The vault sits behind that login, so a code you need to get through NCSMFA is no use to you if it’s locked inside NCSMFA. Keep that one on your phone’s authenticator.
Getting an account
NCS MIS/IT will reach out and get you set up, and will work with you to move your existing credentials into NCSMCS.
Is it backed up?
Yes, in two senses, which is the part that matters.
The vault sits on storage replicated between Proxmox hosts at our primary site, so a failed drive or a failed machine costs you nothing. Everything is also backed up offsite, which covers the things replication can’t — fire, theft, or any sufficiently bad day at one location.
The distinction is worth knowing: replication means two machines hold the same data at the same moment, which is excellent against hardware failure and useless against a mistake, since a deletion propagates to both instantly. Offsite backup is what protects against mistakes and disasters. You want both. You have both.
Separately, the apps keep an encrypted local copy on your device, so a server outage doesn’t lock you out of your own passwords in the meantime. That’s a convenience during downtime rather than a backup strategy — the two layers above are the actual answer.
Problems
If the app says your credentials are invalid, check the server URL first. It’s the cause the overwhelming majority of the time, and it’s a thirty-second fix.
Anything else: open a ticket at ncshds.northlandcentral.org, email support@ncsmx.org, or call (210) 904-8005.
