arrow-left

All pages
gitbookPowered by GitBook
1 of 1

Loading...

MySQL Plugin

Rotate and Connect to MySQL databases with Keeper Commander

circle-exclamation

Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

  • Password Rotation with KeeperPAM

  • Commander

hashtag
Prerequisites

hashtag
Install PyMySQL

circle-exclamation

The MySQL Commander Plugin requires the PyMySQL plugin version 0.10.1 and does not support more recent versions.

hashtag
Prepare Records for Rotation

hashtag
Create a record to store the MySQL username and password

Create a record using either the Keeper Vault UI, or Keeper Commander.

circle-info

Commander rotation supports all record types. A "Login" field is required on the record.

Set the Host and Port of the record

If using an untyped record, the host and port can be set to custom fields. See below.

circle-info

hashtag
Optional Custom Fields

Label
Value
Comment

For Commander versions greater than 4.88

For Commander versions 4.88 and before

circle-info

for more information about the edit command, see the

hashtag
Rotate Passwords

hashtag
Get Record UID

Find the UID in the record information popup

Use the search command to find the UID for your record. Replace "MySQL Example" with the name of your record.

hashtag
Perform Rotation

To rotate MySQL passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

circle-info

The plugin can be supplied to the command as shown here added to a record field, or automatically assigned based on the port number or based on the host starting with "mysql://" (see options above). Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.

hashtag
Output

After rotation is completed, the new password will be stored in the Password field of the record

hashtag
Integration with the Keeper Commander's connect command

Custom Field Name
Custom Field Value
circle-info

xxx refers to the 'friendly name' which can be referenced when connecting on the command line

Here's a screenshot of the Keeper Vault record for this use case:

circle-info

For more information on the connect command, see the

Commander will use the mysql plugin automatically for records with the port number 3306, or with a hostname that starts with "mysql//"

Set the login and password values to the current database user values

Commander will use the login and password to login to the MySQL account
add type="databaseCredentials" title="MySQL Example" f.host.hostName="127.0.0.1" f.host.port="3306" f.login
="DBAdmin Smith" f.password="XXX"

replace 'XXX' with the current database password for this user

cmdr:rules

# uppercase, # lowercase, # numeric, # special'

(e.g. 4,6,3,8)

Password generation rules

cmdr:port

MySQL port. 3306 assumed if omitted This can be set here if not set in the record's host field

cmdr:user_host

User host. '%' assumed if omitted

pip3 install -Iv PyMySQL==0.10.1

cmdr:plugin

mysql

Tells Commander to use MySQL rotation. This should be either set to the record, or supplied to the rotation command

cmdr:host

Hostname of your MySQL server. This can be set here if not set in the record's host field

 edit -r "MySQL Example" --custom '{"cmdr:plugin":"mysql", "cmdr:host":"SQL"}'
edit "MySQL Example" --custom '{"cmdr:plugin":"mysql", "cmdr:host":"SQL"}'
My Vault> search "MySQL Example"

  #  Record UID              Type    Title    Login    URL
---  ----------------------  ------  -------  -------  -----
  1  am4TuwGrDpn8NhrGPBAWKw  login   rtt      rotate


                 UID: am4TuwGrDpn8NhrGPBAWKw
               Title: rtt
               Login: rotate
                text: ['mysql']
                text: ['127.0.0.1']
rotate "MySQL Example" --plugin mssql

connect:xxx:env:MYSQL_PWD

${password}

connect:xxx

mysql -u${login} -h${cmdr:host}

KeeperPAM commands
command documentation
documentation
Creating a record in the Keeper Vault
Adding Custom Fields in the Vault UI
Click the Record UID to copy it to the clipboard
A Keeper Record setup for use with Commander's 'connect' command