Video Overview

The basic steps of setting up Secrets Manager is in the video below.

Prerequisites

Keeper Business License

Secrets Manager is available for Business accounts. If you are not a Keeper customer yet, you can start a free trial from our website.

On your workstation:

• You'll need the ability to install Python version (3.6+)

• PIP version 21+ (Included in Python)

• Keeper Commander CLI (Make sure you can login)

Getting Started

First, we need to follow a few steps to enable Secrets Manager for your Keeper account.

Enable Secrets Manager

To activate your trial of Keeper Secrets Manager, login to the Admin Console and click on "Secrets Manager".

Create a Role

Create a Keeper account role that will be used by Secrets Manager users. Keeper account roles can be created in the Admin Console.

Click "Add Role" to create a new role, give it a name like "Secrets Managers".

Enable Secrets Manager for the Role

Enable Application Access for roles in the Keeper Secrets Manager enforcement policies.

1. Select the Role

2. Open Enforcement Policies

3. Choose Keeper Secrets Manager tab

4. Enable Keeper Secrets Manager policy

Setup Secrets Manager

In this exercise you will setup Secrets, create an Application, and configure a Client in order to access your secrets using Keeper Secrets Manager.

From here, Secrets Manager can be setup using the Keeper Vault, or Keeper Commander. The following instructions show the steps for using the Keeper Vault. For Commander CLI steps, see the instructions at the bottom of this page.

Create a Secret

Secrets are stored as records in the Keeper Vault and are typically stored as attachments or fields in these records.

Learn more about Secrets Manager Secrets

In the Keeper Web Vault or Desktop App user interface, create a Shared Folder and then add Secrets to the folder.

Create a shared folder

Click "Create New" and choose "Shared Folder"

Enter a name and click "Create" to create a new shared folder.

With the new shared folder selected, click the "Create New" button and select "Record" to create a new record inside the shared folder

Create a Secrets Manager Application

Secrets are shared to Applications as records or shared folders. Applications maintain client devices, permissions, audit trail, and history. Learn more about Secrets Manager Applications

In the Keeper Vault, navigate to the Secrets Manager tab to see a list of Secrets Manager applications. Then click "Create Application"

Enter a name for the new Secrets Manager Application

Next choose the shared folder(s) to share with the new Application. The Application will only have access to the records in the selected folder(s).

You can choose to give the Application Read Only or Write access to the Vault records, and choose if the first Secrets Manager Client Device should be locked to the first IP address that accesses Secrets Manager. (More on Client Devices below)

Click "Generate Access Token" to create the Application and automatically create the first Secrets Manager Client Device.

Create a Secrets Manager Client Device

A Client Device is any endpoint that needs to access secrets associated with an Application. This can be a physical, virtual, or cloud-based device. Learn more about Secrets Manager Client Devices

When a Secrets Manager Application is created in the Keeper Vault, a Secrets Manager Client Device is also created.

When a Client Device is created, a One-Time Access Token is generated and displayed. You will need this One-Time Access Token later in the guide. Copy or download the token to use later.

Create Additional Client Devices (optional)

Once the Secrets Manager Application is created, more Client Devices can be created for the Application.

See the documented instructions to create additional Client Devices and One-Time Access Token

View Secrets

Next we'll view the secrets from the Keeper Vault shared with Secrets Manager using the Secrets Manager CLI.

Secrets Manager has SDKs in various languages and many pre-built integrations which can be used to access secrets.

For this example we will use the Secrets Manager CLI tool (ksm) to fetch and view secrets from the Keeper Vault.

Install the Secrets Manager CLI

Installing using binary release

The latest binary release can be found on the GitHub repository. Download the installer based on your operating system and click to install, or unarchive, to use.

When launching the CLI in Windows or macOS, via the UI, the CLI will run in a shell mode. The ksm command is still available via the command line.

The Linux binary is just an executable and should be moved to a directory in the PATH.

Installing KSM using pip3 and Python3

If you prefer to install using pip3 and Python3, use the commands below:

sudo pip3 install --upgrade pip
sudo pip3 install keeper-secrets-manager-cli

If pip3 is not installed on your system, make sure to install Python3. For example, using yum:

sudo yum install python3

Connect Keeper Secrets Manager CLI to the Secrets Manager Application

Initialize the CLI using the One-Time Access Token obtained above.

$ ksm profile init --token PASTE_TOKEN_HERE

Access Your Secrets

To retrieve a list of all secrets, use the ksm secret list command:

$ ksm secret list

The CLI should show a list of secrets shared with the Secrets Manager Application.

 UID                     Record Type          Title
 ----------------------- -------------------- ---------------
 bf3dg-99-JuhoaeswgtFxg  login                My Secret
 3FXqmP5nFKwju0H8pl0DmQ  databaseCredentials  MySQL Credentials

Finishing Up

Next steps:

• Schedule time with the Secrets Manager team to discuss your use case

• Learn about integrating Keeper Secrets Manager with your software using the SDKs

• Learn more about the Secrets Manager CLI

• Learn about accessing secrets from CI/CD systems with Integrations

Have questions? Contact sm@keepersecurity.com

Setup Using Keeper Commander CLI

If preferred, Secrets Manager can be setup using Keeper's command line tool Commander instead of the Keeper Vault. Follow these steps to setup Secrets Manager using Keeper Commander.

See the Commander Documentation for installation instructions.

Enable Secrets Manager for a Role

In some cases, Commander is needed to enable Secrets Manager for a Keeper role. To do this, use the following command:

enterprise-role "Keeper Admin" --enforcement "ALLOW_SECRETS_MANAGER:True"

Create a Secret

Secrets are stored as records in the Keeper Vault and are typically stored as attachments or fields in these records.

Learn more about Secrets Manager Secrets

Run Keeper Commander by typing keeper shell then login with your Keeper email:

$ keeper shell
  _  __  
 | |/ /___ ___ _ __  ___ _ _ 
 | ' </ -_) -_) '_ \/ -_) '_|
 |_|\_\___\___| .__/\___|_|
 vXX.X.X      |_|

 password manager & digital vault

Not logged in> login me@company.com

After logging in:

• Create a Secret

• Create a Shared Folder

• Move the secret into the Shared Folder.

Example commands are shown below:

My Vault> add --login admin --pass "46$$62512%Rd1" --url "192.168.1.1" -t "My Secret"
My Vault> mkdir -sf -a "DevOps Secrets"
My Vault> mv "My Secret" "DevOps Secrets"

Create a Secrets Manager Application

Secrets are shared to Applications as records or shared folders. Applications maintain client devices, permissions, audit trail, and history.

Learn more about Secrets Manager Applications

In the example below, replace XXX with the Shared Folder UID or Record UID from your vault.

My Vault> secrets-manager app create MyApplication
My Vault> secrets-manager share add --app MyApplication --secret XXX

Create a Secrets Manager Client Device

A Client Device is any endpoint that needs to access secrets associated with an Application. This can be a physical, virtual, or cloud-based device.

Learn more about Secrets Manager Client Devices

Create a client device to generate a One Time Access Token, which is used to initialize a device.

My Vault> secrets-manager client add --app MyApplication

Successfully generated Client Device
====================================

One-Time Access Token: US:4d8THSdmLZOeqZubMNqKWKcrgh7SyQiAQ9afVI0IL0I
IP Lock: Enabled
Token Expires On: 2021-08-26 12:03:23
App Access Expires on: Never

Continue Quick Start Guide

From this point forward, follow the instructions above to access Secrets using Secrets Manager and complete this guide.

What is Keeper Secrets Manager?

Keeper Secrets Manager (KSM) provides your DevOps, IT Security and software development teams with a fully cloud-based, Zero-Knowledge platform for managing all of your infrastructure secrets such as API keys, Database passwords, access keys, certificates and any type of confidential data.

Common use cases for Secrets Manager include:

• Removing hard-coded credentials from source code

• Replacing configuration file secrets

• Pulling secrets into CI/CD systems like Jenkins, GitHub Actions and More

• Protecting access to privileged passwords, API keys and other managed secrets

• Providing vault access to machines and applications

• Automatically rotating passwords, service account credentials and cloud identities

Features

• No hosted software or VMs to configure and manage (100% Cloud-based)

• Secure and user-friendly Web Vault and Browser Extensions for secrets management

• Automated password rotation across any target user or machine

• Powerful native Mobile and Desktop Applications for every device type and OS

• Admin Console for managing enforcement policies, users, teams and provisioning

• SAML 2.0 and Master Password user login methods

• Shared passwords and secrets among Teams and individual users

• Simple and fast deployment methods

• Developer-friendly SDKs for the most popular programming languages and environments

• Built for all users - not just DevOps!

• Advanced Reporting & Alerts for audit and compliance

• Integration with Slack and Microsoft Teams

• Dedicated 24/7 support

• SOC2, ISO27001 certified

• FIPS 140-2 validated

• FedRAMP Authorized and StateRAMP Authorized

Get Started

Overview

Information about how Keeper Secrets Manager works.

Common Functionality

Additional details about aspects of Keeper Secrets Manager which are used across many integrations and SDKs.

Additional Resources

Information about other Keeper systems that impact Secrets Manager users.

Keeper Secrets Manager

Keeper Secrets Manager provides your DevOps, IT Security and software development teams with a fully cloud-based, Zero-Knowledge platform for managing all of your infrastructure secrets.

Keeper Commander

Keeper Commander is Keeper's feature rich CLI interface to Keeper® Password Manager. Useful for power users, system admins and various automation tasks.

About Keeper

Keeper Security is the leading password security platform to protect your enterprise from password-related data breaches and cyberthreats.

Platform Benefits

Protects Your Organization Against Ransomware Attacks Keeper protects your organization against ransomware attacks using robust administration, controls and visibility over strong password security and real-time dark web monitoring. Mitigates Risk of Data Breaches Keeper uses a proprietary, zero-knowledge security architecture that supports on-prem, cloud and hybrid-cloud environments for client-side encryption key management.

Bolsters Security and Privacy Each employee gets a private, encrypted vault for storing and managing their passwords, credentials, files and private client data.

Boosts Employee Productivity Reduces help desk costs, saves employees time, reduces frustration and eliminates the need for employees to reuse and remember passwords.

Enables Secure Sharing of Credentials and Secrets Keeper allows IT Admins to enable secure, granular and controlled sharing of credentials, secrets and vaults among employees and teams.

Robust Compliance and Reporting Supports role-based access controls, 2FA, auditing, event reporting and industry compliance with NIST, PCI DSS, SOC 2, ISO 27001, HIPAA, DPA, FINRA and GDPR.

Keeper also helps organizations meet and satisfy Sarbanes-Oxley (SOX) compliance requirements by enforcing internal controls and security safeguards to protect an organization's financial data and digital assets.

Signing Up

Integration with Keeper Password Manager

Keeper's end-user applications on the Web Vault, Desktop App, Browser Extension and Mobile Apps are built for more than just secrets.

The Keeper Admin Console provides advanced user provisioning, role enforcement policies, SSO integration, SIEM reporting, security scoring and dark web monitoring of secrets.

In addition to protecting all of your DevOps secrets, Keeper protects all of your end-users as a world class Enterprise Password Manager. Keeper can be deployed alongside any Single Sign-On solution such as Microsoft Azure, Okta, Ping, Duo or any other SAML 2.0 compatible identity provider.

Keeper's Security Audit provides insights into the password and secret strength across your infrastructure and end-users.

Keeper supports integration into any 3rd party SIEM solution like Splunk, Azure Sentinel or any other Syslog-compatible solution.

System Architecture

In Keeper's model, all your servers, CI/CD pipelines, developer environments and source code pull secrets from a secure API endpoint.

The client device retrieves encrypted ciphertext from the Keeper cloud and the secrets are decrypted locally on the device (not on the server). Each secret is encrypted with a 256-bit AES key, and then encrypted again by another AES-256 Application Key.

In addition to Zero-Knowledge encryption, every request to the server is additionally encrypted with an AES-256 Transmission Key on top of TLS to prevent MITM or replay attacks. This multi-layered cryptography is handled transparently using our client-side SDKs which are easy to integrate into any environment.

High Availability and Local Cache

Keeper's infrastructure serves requests for millions of users and tens of thousands of Enterprise customers every day.

Keeper Secrets Manager benefits from the existing Keeper platform architecture in addition to an optional offline caching mechanism in all Secrets Manager SDK endpoints.

Each client device platform provides an optional local caching components. If the Keeper endpoint is unavailable, the Client Device will pull the last requested Secrets from a local encrypted cache.

Encryption Model