Rotation Commands

Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.

To get help on a particular command, run:

help <command>

rotate command:

Command: rotate or r

Detail: Rotate a record's password

To be eligible for rotation, a record must have the custom field 'cmdr:plugin'='noop'

Parameters:

Record name or UID to rotate

Switches:

--print display updated record content after rotation

--match <REGULAR EXPRESSION> select all records that match this expression to rotate

--password <NEW PASSWORD> sets a new password. Commander generates random password if switch omitted. Ignored when passwords are rotated with --match parameter.

Examples:

1. Rotate the password of the record titled "dev" in the "servers" folder

2. Rotate the password of the record with the given UID

3. Rotate the password of all records that end with "machine" (Using regex)

4. Rotate the password of the give record UID with the specific password provided

set command:

Command: set

Detail: Set an environment variable

Parameters:

environment name, value to set

format:

set <name> <value>

Examples:

Set the MySecret variable to XXX

echo command:

Command: echo

Detail: Display environmental variables

Parameters:

argument to display (optional)

format:

echo ${<variable>}

If no argument is given, all environment variables are shown

Examples:

1. Display all currently set environment variables

2. Display the value for the MySecret variable

Password Rotation

Keeper Commander has a feature which can communicate to internal and external systems for the purpose of rotating a password and synchronizing the change to your Keeper Vault. We accomplish this by associating a Keeper record with a physical system through the use of custom fields. For example, you might want to rotate your MySQL password, Active Directory password and local Administrator password automatically.

Typed Records

Typed records add simplicity to Commander rotation. Commander can scan fields and make intelligent decisions about the rotation type, and connection details. Record types such as the standard "SSH Key" or "Server" types make it easy to create records that are ready for rotation.

Each rotation plugin has slightly different requirements, select from the list of plugins on the left nested under this page to learn more.

Commander will identify the type of rotation to use automatically based on the values supplied to the record. For example a record with a PORT value of 22 will use the SSH rotation plugin by default. The rotation plugin can also be specified during rotation or with a custom record field.

Optionally, any records can use custom fields as configuration for rotation. See table below for an example of custom fields.

Untyped Records

Older, non-typed records require some additional setup in order to support Commander rotation.

To support a rotation plugin, simply add a set of custom field values to the Keeper record. The custom field values tell Commander which plugin to use, and what system to communicate with when rotating the password. To modify your Keeper record to include custom fields, login to Keeper on the or app.

Example custom fields for MySQL password rotation:

When a plugin is specified in a record, Commander will search in the plugins/ folder to load the module based on the name provided (e.g. mysql.py) then it will use the values of the Keeper record to connect, rotate the password and save the resulting data.

Check out the for all of the available plugins. Keeper's team adds new plugins on an ongoing basis. If you need a particular plugin created, send us an email to .

Supported Plugins

Github Location

Activating a Plugin

To activate a plugin for a particular Keeper record, you first need to update the custom fields for that record with special keywords that are used by Commander. See the specific plugin for the custom field requirements.

To perform a rotation use the rotate command.

Keeper's team is expanding the number of plugins on an ongoing basis. If you need a particular plugin created or modified, email us at .

This plugin generates/rotates Azure AD password for any user.

Prerequisites

Install

Configure Azure Application to have User Administrative Privileges

Prepare Records for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

Set the Azure Login Name

Populate the 'Login' field of the Keeper record with the Azure login name

Add Required Fields

The following fields are required for Azure AD rotation. Create each field with the label indicated and supply the required information.

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Rotate

To rotate Azure passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Output

After rotation is completed, the new password will be stored in the Password field of the record

Prerequisites

1. Install AWS CLI package

2. Configure AWS CLI package

Install AWS CLI if necessary

Configure AWS Connection with the AWS CLI

Prepare Records for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. Additional fields may be added depending on the rotation type as well. See the instructions below.

Rotation Types

Rotate AWS Keys

To run a rotation of AWS Keys, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Additional Rotation Options

The following optional values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Output

After rotation is completed, the Access Key ID and Secret Key are stored in custom fields on the record with labels: cmdr:aws_key_id and cmdr:aws_key_secret.

Any Keeper user or Keeper Shared Folder associated with the record is updated instantly.

Rotate AWS Passwords

To run a rotation of AWS passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Additional Rotation Options

The following optional values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Output

The Password field of the Keeper record contains a new password to AWS account.

You can automate password resets using Commander plugins, with a custom Commander configuration file

Example:

In this example, we are telling Commander to first download and decrypt records, then rotate the password (record UID iaOXP1fnApRh5DbaRd7MWA) using the plugin programmed into the record. To locate the Record UID, simply view it on the commander interactive shell or view it on the Keeper Web Vault and Desktop App (as seen below).

This plugin allows rotating a user's password in Oracle Database Server

Prerequisites

Install cx_Oracle

Prepare Record for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

Add the following Custom Fields to the record that you want to rotate within Keeper

To connect with DSN string:

To connect using database host and service name

The following optional plugin field can be added to enforce use of the Oracle rotation plugin

The plugin will use the Login field as the username of the password command when rotating a password.

Record Example:

Rotate

To rotate Oracle passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Output

After rotation is completed, the new password will be stored in the Password field of the record

This plugin provides IT Admins with the ability to rotate the password of a remote system's administrative local password. The password is rotated using the widely used "pspasswd" utility and the change is synchronized to a specific Keeper record in your vault.

The way this plugin is implemented requires that Commander and pspasswd is installed on the Domain Controller.

Prerequisites

Enabled Remote Service Management on each target computer

Assuming all computers are domain-attached and reachable from the Domain Controller, ensure that "Remote Service Management" is allowed for inbound in Domain by enabling the relevant Firewall rule on all computers.

On each of the target computers, go to Windows Firewall rules -> Inbound Rules -> and enabled the "Remote Service Management" rule.

Install pspasswd

• Download the from Microsoft

• Extract the PSTools.zip folder to a location on your computer

• Add this PSTools folder to your user or system environmental variable "PATH"

  (System Properties -> Advanced -> Environmental Variables)

  Select PATH and then "Edit"

Prepare Record for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

Set the Login Name

Populate the 'Login' field of the Keeper record with the login to use with this rotation.

Set the Host and Port of the record

If using an untyped record, the host and port can be set to custom fields. See below.

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Rotate

To rotate PSPasswd passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Output

After rotation is completed, the new password will be stored in the Password field of the record

The SSH plugin for Keeper Commander gives you the ability to generate and rotate SSH keys to one or more target systems, or rotate any local or remote user's Unix/Linux password.

Prerequisites

SSH Key Rotation

Install OpenSSL and OpenSSH

This plugin requires OpenSSL and OpenSSH packages to be installed on the computer running Keeper Commander.

To verify Installation, open the Terminal application and make sure 'openssl' and 'ssh' commands are installed and accessible with the system PATH environment variable.

SSH Password Rotation

Plugin name: ssh

Prepare a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

The standard "SSH Key" record type is a good fit for SSH rotations.

Set the Login Name

Populate the 'Login' field of the Keeper record with the target system(s) login name

Set the Hostname and Port

If using an untyped record, the host and port can be set to custom fields. See below.

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Rotate

SSH Key Rotation

First Time Setup and Run

When setting up this plugin for the first time please use the following steps:

1. Populate Keeper Record

Populate the Title, Login, and Hostname or IP and Port fields of the Keeper record.

2. Execute rotate command and store public key

Execute the rotate command on the Keeper shell for this record. Commander will generate the public and private keys and store them in the record. Copy or save the public key and save this to the file .ssh/authorized_keys in the target hosts - this step must be done manually the first time or you can use the ssh-copy-id unix command.

Make sure to set the permissions of the authorized_keys file on the target system. chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys

3. Execute key rotation

Execute rotate command on Keeper shell to perform a full rotation. If successful, the target hosts will be updated with the newly generated public key and the Keeper record will be updated with the private/public key pair.

SSH Passwords Rotation

To rotate SSH passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

This plugin allows rotating a windows user's password using the net user command.

Prepare a Record for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

Set the Login Name

Populate the 'Login' field of the Keeper record with the login to use with this rotation.

This plugin rotates passwords for both local and Active Directory accounts. When rotating Active Directory password use DOMAIN\USERNAME syntax for Login field.

Add the following Custom Fields to the record that you want to rotate within Keeper

Rotate

To rotate Windows passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

Output

After rotation is completed, the new password will be stored in the Password field of the record