Unix Passwd Plugin

Rotate Unix passwords with Commander

Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

• Password Rotation with KeeperPAM

• Commander KeeperPAM commands

This plugin allows rotating a local user's password using the Unix passwd command.

Prerequisites

Install pexpect

pip3 install pexpect

Prepare a Record for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

See the Troubleshooting section for more information on legacy vs typed records

Set the Login Name

Populate the 'Login' field of the Keeper record with the login to use with this rotation.

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Name	Value	Comment
cmdr:plugin	unixpasswd	(Optional) Tells Commander to use Unix password rotation. This should be either set to the record, or supplied to the rotation command
cmdr:rules	# uppercase, # lowercase, # numeric, # special' (e.g. 4,6,3,8)	(Optional) Password generation rules

Keeper Record setup for Unix passwd rotation

Rotate

To rotate Unix passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

rotate "My Azure Credentials" --plugin unix

The plugin can be supplied to the command as shown here, or added to a record field (see options above). Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.

Output

After rotation is completed, the new password will be stored in the Password field of the record