What are Keeper Connections?

Keeper Connections allow users to instantly and securely access assets within their target infrastructure, such as servers, databases, web apps and workloads directly from their Keeper Vault. Connections can be established without exposing the underlying credentials to the user, ensuring zero-trust and zero-knowledge access.

Keeper Connections are configured on PAM Machine, PAM Database, PAM Directory and PAM Remote Browser record types, and once configured, connections are launched directly from these records.

One of the key features of Keeper Connections is the agentless and clientless architecture. Organizations need to install only a Keeper Gateway in each managed environment. This streamlined approach simplifies deployment and enhances security by centralizing access management.

Connection User Interface

Connections are launched directly from the Vault interface with one click. The connection is established between the Keeper Gateway and the target machine, and the session is visually projected into the Vault where you can interact seamlessly.

Click "Launch" to open a privileged session.

Sessions are opened directly inside the Keeper vault, establishing a zero trust encrypted connection to the target.

Full screen mode and zoom controls are available from the upper right corner of the window.

Connection Dock

The Connection Dock provides instant switching between active sessions. The dock can be moved to any desired location on the screen.

The dock can be minimized and moved anywhere on the screen.

How do Keeper Connections Work?

When launching a connection, the Web and Desktop Vault Client will render a window with the established connection protocol to the specified target defined on the PAM record. This is done by:

1. The Vault Client communicating with the Keeper Gateway with the relevant connection info through a secure tunnel

2. The Keeper Gateway then establishes the connection protocol to the target defined on the PAM Record

3. After establishing the connection, the Keeper Gateway projects the visual session to the Keeper vault client.

For more information on the architecture, see this page.

Why Use Keeper Connections?

IT Admins, DevOps and development teams struggle with protecting access to cloud and on-prem infrastructure to endpoints like remote desktops, Windows machines, Linux Servers, critical web-based apps, Kubernetes clusters and Databases.

Keeper Connections protects your business, your employees and your customers against data breaches by providing a unified vault for all access and control. Reducing risk and simplifying access are the core tenants of the Keeper platform.

• Lower complexity: All zero trust access is managed by the Keeper Vault

• Lower employee risk: No VPNs, No ZTNAs and no Agents

• Lower supply chain risk: No client-side connection apps

• Lower attack surface risk: Zero-knowledge encryption and networking

Keeper Connection Features

• Support for RDP, SSH, VNC, K8s, telnet remote access protocols

• Support for MySQL, PostgreSQL, SQL Server database protocols

• Remote browser isolation (http/https) protocol for web-based apps

• Drag-and-drop file transfer via SFTP to target machines

• Session Recording and playback

• Privileged Session Management

• Role-Based Access Controls

To get started with Keeper Connections, proceed to the next section.

Overview

In this guide, you will learn how to setup connections for all the supported protocols on your PAM Record types in your Keeper Vault.

Prerequisites

Prior to configuring Connections, make sure to have the following:

Connection Enforcement Policies

The following Enforcement Policies affect user's permissions to use Connections and need to be enabled.

Enforcement policies for KeeperPAM are managed in the Keeper Admin Console under Admin > Roles > Enforcement Policies > Privileged Access Manager.

ALLOW_CONFIGURE_PAM_CLOUD_CONNECTION_SETTINGS

ALLOW_LAUNCH_PAM_ON_CLOUD_CONNECTION

ALLOW_VIEW_KCM_RECORDINGS

Tunnels can also be enabled on the Keeper Commander CLI using the enterprise-role command:

enterprise-role "My Role" --enforcement "ALLOW_CONFIGURE_PAM_CLOUD_CONNECTION_SETTINGS":true
enterprise-role "My Role" --enforcement "ALLOW_LAUNCH_PAM_ON_CLOUD_CONNECTION":true
enterprise-role "My Role" --enforcement "ALLOW_VIEW_KCM_RECORDINGS":true

Enforcement Policy Use Cases

If a user should only have access to launching connections and not configuring connections, then only "Can start connections" policy should be enabled for the user.

In addition to launching connections, If a user should also have access to configure connections, then "Can configure connections settings" and "Can start connections" should be enabled for the user.

Session Recordings

Launched connections can also be recorded. These recordings are available on the PAM Machine, PAM Database, or PAM Directory record types and can be played back on your Vault. For more details on session recording and playback, visit this page.

Installing the Keeper Gateway

The Keeper Gateway is a hosted agentless service that is installed on the customer's network to enabled zero-trust access to target infrastructure. Typically this service is installed on a Linux or Docker environment in each of the networks that requires access.

For more details on installing and setting up your gateway, visit this page.

PAM Configuration

The PAM Configuration contains essential information of your target infrastructure, settings and Keeper Gateway. Setting up a PAM Configuration for your infrastructure is required. For more information on creating and configuring the PAM Configuration, visit this page.

PAM Machine, PAM Database and PAM Directory

A Keeper Connection is a secure, encrypted interactive session established between your vault client to the target endpoint. The target endpoint needs to be defined on one of the following PAM Record types:

Depending on your target endpoint, visit the corresponding PAM Record Type page for more information on setup.

Supported Connection Protocols

The following table lists all the supported connection protocol that can be configured in your Keeper Vault. Visit the associated link for each protocol for more details on configuration.

Supported Connection Protocols

The following table lists all the supported connection protocols that can be configured in your Keeper Vault to establish zero-trust privilege sessions. Visit the associated link for each protocol for more details on configuration.

Overview

KeeperPAM enables zero-trust privileged session management for target infrastructure using the SSH protocol. This guide explains how to set up SSH connections on your PAM Machine Records in the Keeper Vault. Secure SSH sessions are established from the Vault, through the Keeper Gateway, and directly to target devices.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a Linux server to represent a PAM Machine record.

PAM Settings - Configuring SSH Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the SSH protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable connection settings for the SSH protocol on the PAM Settings:

Starting a Connection

Once you have configured the SSH Protocol connection on your PAM Machine Record, your record will contain the following connection banner with the "Launch" Button:

In the above image, a Linux server has been configured on the PAM Machine Record. When clicking launch, the Vault Client will render a window with the established connection protocol to the specified target:

File Transfers

Transfer In

If the SFTP file transfer feature is enabled, the user can drag and drop files into the terminal session to transfer the files to the machine.

Keeper supports one or more files transferred simultaneously through drag-and-drop.

While the files are being uploaded to the target machine, a file transfer status is displayed in the dock area of the Keeper Vault:

Transfer Out

To transfer files from the SSH remote connection to the local filesystem, you can download a tool called guacctl into the remote system and use it for performing outbound transfers.

Download guacctl and set as executable:

wget https://raw.githubusercontent.com/apache/guacamole-server/master/bin/guacctl
chmod +x guacctl

Initiate the file download using this syntax:

./guacctl -d <filename>

SSH to Windows Servers

The SSH protocol can also be used to access Windows servers for execution of PowerShell commands or other administrative actions.

• Learn more on how to activate SSH on Windows

Session Recordings - SSH Protocol

Overview

KeeperPAM enables zero-trust privileged session management for target infrastructure using the RDP protocol. This guide explains how to set up RDP connections on your PAM Machine Records in the Keeper Vault. Secure RDP sessions are established from the Vault, through the Keeper Gateway, and directly to target devices.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a Azure VM as an example. For more details on how this is setup on the PAM Machine Record, visit the following page:

PAM Settings - Configuring RDP Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the RDP protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable settings for the RDP protocol on the PAM Settings:

Troubleshooting Connections

When troubleshooting authentication and connection issues, check the following:

• Ensure the user specified in the linked PAM User record has the rights to RDP to the target machine.

• Adjust your group policy or add the user to the "Remote Desktop Users" group on Windows to grant access.

• For additional troubleshooting, refer to the Gateway logs which will contain additional information. The location of the Gateway logs depends on the installation method.

Session Recordings - RDP Protocol

Overview

KeeperPAM enables zero-trust privileged session management for MySQL databases through an interactive CLI. This guide shows how to configure MySQL connections on your PAM Database Records in the Keeper Vault. Sessions are securely initiated from the Vault, routed via the Keeper Gateway, and connected to target databases.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a MySQL Database. For more details on how this is setup, visit the following page:

• Example: MySQL Database

PAM Settings - MySQL Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the MySQL protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable settings for the MySQL protocol on the PAM Settings:

Session Recordings - MySQL Protocol

Overview

KeeperPAM enables zero-trust privileged session management for SQL Server databases through an interactive CLI. This guide shows how to configure SQL Server connections on your PAM Database Records in the Keeper Vault. Sessions are securely initiated from the Vault, routed via the Keeper Gateway, and connected to target databases.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a SQL Database. This is similar to setting up a MySQL database, for more details on how this is setup, visit the following page:

• Example: Microsoft SQL Server Database

PAM Settings - SQL Server Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the SQL Server protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable connection settings for the SQL Server protocol on the PAM Settings:

Session Recordings - SQL Server Protocol

Overview

KeeperPAM enables zero-trust privileged session management for PostgreSQL databases through an interactive CLI. This guide shows how to configure PostgreSQL connections on your PAM Database Records in the Keeper Vault. Sessions are securely initiated from the Vault, routed via the Keeper Gateway, and connected to target databases.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a PostgreSQL Database. For more details on how this is setup, visit the following page:

• Example: PostgreSQL Database

PAM Settings - PostgreSQL Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the PostgreSQL protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable connection settings for the SQL Server protocol on the PAM Settings:

Session Recordings - PostgreSQL Protocol

Overview

KeeperPAM enables zero-trust privileged session management for target infrastructure using the VNC protocol. This guide explains how to set up VNC connections on your PAM Machine Records in the Keeper Vault. Secure VNC sessions are established from the Vault, through the Keeper Gateway, and directly to target devices.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a Azure VM. For more details on how this is setup on the PAM Machine Record, visit the following page:

PAM Settings - Configuring VNC Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the VNC protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable settings for the VNC protocol on the PAM Settings:

Session Recordings - VNC Protocol

Overview

KeeperPAM enables zero-trust privileged session management for target infrastructure using the Telnet protocol. This guide explains how to set up Telnet connections on your PAM Machine Records in the Keeper Vault. Secure sessions are established from the Vault, through the Keeper Gateway, and directly to target devices.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a Linux Machine. For more details on how this is setup on the PAM Machine Record, visit the following page:

PAM Settings - Configuring Telnet Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the Telnet protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable connection settings for the Telnet protocol on the PAM Settings:

Session Recordings - Telnet Protocol

Overview

KeeperPAM enabled zero-trust privileged session management for Kubernetes containers using Kubernetes' REST API. This guide shows how to configure Kubernetes connections on your PAM Machine Records in the Keeper Vault. Secure Kubernetes sessions are established from the Vault, through the Keeper Gateway, and directly to the target container.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

PAM Settings - Configuring Kubernetes Protocol

Accessing Connection Settings

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the Kubernetes protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable connection settings for the Kubernetes protocol on the PAM Settings:

Session Recordings - Kubernetes Protocol

Overview

KeeperPAM enables zero-trust privileged session management for web applications using the Remote Browser Isolation (RBI) protocol. This guide explains how to configure RBI connections on your PAM Remote Browser Records in the Keeper Vault. Secure web sessions are initiated from the Vault, routed through the Keeper Gateway, and delivered directly to target applications.

Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's Getting Started page.

The following PAM records are needed in order to successfully setup this protocol:

This guide will use a Jenkins web application.

PAM Settings - Configuring RBI

Accessing Connection Settings

After creating a PAM Remote Browser with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record

2. Clicking on "Set Up" in the PAM Settings section

3. Navigate to the "Connection" section in the prompted window

Configuring Connection Settings

Prior to configuring the RBI protocol settings on the PAM Settings screen, the following fields are all required and need to be configured:

The following table lists all the configurable settings for the RBI protocol on the PAM Settings:

Session Recordings - RBI Protocol

For this protocol, graphical data, including timing information, is recorded. For more details on the recordings and how to access them, see the Session Recording & Playback docs.

A few example guides explain how to set up Connections:

• SSH Protocol with Linux Machine

• RDP Protocol with Azure Virtual Machine

• MySQL Protocol with Database

• PostgreSQL Protocol with Database

Overview

In this guide, you will learn how to configure a Azure Virtual Machine on your PAM Machine and configure the RDP protocol to successfully launch a zero-trust connection to the Azure Virtual Machine — directly from your Keeper Vault.

Summary

For this setup, you need to do the following:

After completing the above, you can launch zero-trust connections to the Azure Virtual Machine directly from your Keeper Vault.

Step 1 - Enable Connection Enforcement Policies

From the Admin Console, enable the corresponding PAM Enforcement Policies for connections:

ALLOW_CONFIGURE_PAM_CLOUD_CONNECTION_SETTINGS

ALLOW_LAUNCH_PAM_ON_CLOUD_CONNECTION

ALLOW_VIEW_KCM_RECORDINGS

Step 2 - Install and configure the Keeper Gateway

Prior to creating the PAM Record types in your Vault, the Keeper Gateway needs to be installed in your infrastructure. Visit the following guides based on your needs:

• Windows Installation

• Linux Installation

• Docker Installation

Additionally, the Keeper Gateways needs to be configured with the Gateway token. For more information, visit this page.

Step 3 - Configuring the PAM Configuration

The PAM Configuration contains critical information on your infrastructure, settings and associated Keeper Gateway. Visit the following pages for more details based on your target infrastructure:

• Setting up Local Environment on the PAM Configuration

• Setting up AWS Environment on the PAM Configuration

• Setting up Azure Environment on the PAM Configuration

Step 4 - Create and Configure PAM Machine and PAM User(s) Records

After setting up your Gateway and PAM Configuration Record, the Azure Virtual Machine and its users need to be configured on PAM Record types in your Vault:

• PAM Machine - The Azure Virtual machine is configured on this record type

• PAM User - The Azure Virtual User is configured on this record type

Refer to this example on how to configure Azure Virtual Machine on a PAM Machine record type:

Step 5 - Configuring PAM Settings and RDP Protocol

The PAM Machine record type contains the necessary information required for the Keeper Gateway to locate and establish a connection with the machine, while the PAM User record type contains the necessary information to authenticate the connection.

The PAM Settings need to be configured to enable connections or tunnels on the target defined on the PAM Machine Record. To configure the RDP protocol, visit the following page:

Launching Connections

Once you have configured the RDP Protocol connection on your PAM Machine Record, your record will contain the following connection banner with the "Launch" Button:

In the above image, an Azure Virtual Machine has been configured on the PAM Machine Record. When clicking launch, the Vault Client will render a window with the established connection protocol to the specified target:

Sharing PAM Machine Records

PAM Machine records can be shared with other Keeper users within your organization. However, the recipient must have the appropriate PAM enforcement policies in place to utilize KeeperPAM features on the shared PAM records.

When sharing a PAM Machine record, the linked admin credentials will not be shared. For example, if the PAM Machine is configured with an Azure Virtual Machine, the recipient can connect to the Azure Virtual Machine on the PAM Machine record without having direct access to the linked credentials.

Overview

In this guide, you will learn how to configure a PostgreSQL Database on your PAM Database and configure the PostgreSQL protocol to successfully launch a zero-trust connection to the PostgreSQL Database — directly from your Keeper Vault.

Summary

For this setup, you need to do the following:

1. Enable the Connection Enforcement Policies

2. Install and Configure the Keeper Gateway

3. Create and configure the PAM Configuration File

4. Create the PAM Database and PAM User record types

5. Configure PAM Settings and the PostgreSQL Connection Protocol

After completing the above, you can launch zero-trust connections to the PostgreSQL Database directly from your Keeper Vault.

Step 1 - Enable Connection Enforcement Policies

Step 2 - Install and configure the Keeper Gateway

Prior to creating the PAM Record types in your Vault, the Keeper Gateway needs to be installed in your infrastructure. Visit the following guides based on your needs:

Step 3 - Configuring the PAM Configuration

Step 4 - Create and Configure PAM Database and PAM User(s) Records

After setting up your Gateway and PAM Configuration Record, the PostgreSQL Database and its users need to be configured on PAM Record types in your Vault:

Refer to this example on how to configure PostgreSQL Database on a PAM Database record type:

Step 5 - Configuring PAM Settings and PostgreSQL Protocol

The PAM Database record type contains the necessary information required for the Keeper Gateway to locate and establish a connection with the database, while the PAM User record type contains the necessary information to authenticate the connection.

The PAM Settings need to be configured to enable connections or tunnels on the target defined on the PAM Database Record. To configure the PostgreSQL protocol, visit the following page:

Launching Connections

Once you have configured the PostgreSQL Protocol connection on your PAM Database Record, your record will contain the following connection banner with the "Launch" Button:

In the above image, a PostgreSQL Database has been configured on the PAM Database Record. When clicking launch, the Vault Client will render a window with the established connection protocol to the specified target.

Sharing PAM Database Records

PAM Database records can be shared with other Keeper users within your organization. However, the recipient must have the appropriate PAM enforcement policies in place to utilize KeeperPAM features on the shared PAM records.

When sharing a PAM Database record, the linked admin credentials will not be shared. For example, if the PAM Database is configured with a PostgreSQL Database, the recipient can connect to the PostgreSQL Database on the PAM Database record without having direct access to the linked credentials.