Keeper Secrets Manager
Search
⌃K

Secrets Manager Commands

Commands to configure and manage the Keeper Secrets Manager platform

Overview

Keeper Secrets Manager is a cloud-based, Zero-Knowledge platform for DevOps and engineering teams to centrally manage and control access to privileged accounts. Common use cases for Secrets Manager include:
  • Removing hard-coded credentials from source code, configuration files and CI/CD systems
  • Protecting access to privileged passwords, API keys and other managed secrets.
  • Providing vault access to machines and applications.
In Keeper Secrets Manager, an "Application" is created for every target environment which needs access to a specific folder in the Keeper Vault. An Application can be granted access to one ore more Shared Folders or records within the vault. An Application can be utilized by one or more "Clients" which are individually authenticated and managed by the Secrets Manager infrastructure.
As an example, a Keeper "Application" might represent a production system, and each individual web server in your production system would represent a Client. Each Client authenticates and communicates to the Keeper Vault using a Client ID and a Private Key which is used to sign the request.
The commands in this document can be used to configure the Keeper Secrets Manager applications and client devices.

Create an application

secrets-manager app create <APPLICATION NAME>
My Vault> secrets-manager app create MyApplication

Create a New Secret

This can be done on the Vault user interface, but we'll create a Secret, create a Shared Folder, then move the Secret into the Shared Folder. Example commands are below:
My Vault> add --login admin --pass "46$$625" --url "192.168.1.1" -t "Test Secret"
My Vault> mkdir -sf -a "My Shared Folder"
My Vault> mv "Test Secret" "My Shared Folder"

Share the Folder to the Secrets Manager Application

My Vault> secrets-manager share add --app MyApplication --secret n4QtaKjRjhWMz5aS7bT77Q
To find the Shared Folder or Record UID, use the 'ls -l' command or Vault user interface in the "info" dialog.

Allow a client to access an application

My Vault> secrets-manager client add MyApplication
The output of this command provides the One Time Access Token that will be used on the client.

Get a List of all applications

secrets-manager app list
My Vault> secrets-manager app list
​
List of all Applications
​
Title Uid
--------- ----------------------
PythonApp oXMfwo-hzZNRqMXGvJlccQ
TestApp KtU4eAzor5IpqRW3x4A8FA

View the details of an individual application

secrets-manager app get <APPLICATION NAME|APP UID>
My Vault> secrets-manager app get MyApplication
​
Secrets Manager Application
App Name: MyApplication
App UID: ji__h4gaY3xvQdatVY_ffA
​
Client Device 1
=============================
Name: Device1
Short ID: nWThUIbR
Created On: 2021-10-11 16:26:21
First Access: 2021-10-11 16:27:05
Last Access: 2021-10-11 16:49:47
IP Lock: Disabled
IP Address: --
​
Application Access
Share Type UID Title Permissions
------------ ---------------------- ---------------------- -------------
FOLDER J6xMIXKiwMqIyYJL7kd3xw Secrets Editable
RECORD mux0ZaWKd-h8maggFzy1rw Database Login Read-Only
​

Commands

Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.
To get help on a particular command, run:
help <command>
secrets-manager Command Format
Keeper Secrets Manager commands follow the format:
secrets-manager <command> <sub command>
For example to list all apps use the following command:
secrets-manager app list
A list of all secrets-manager commands and details about each are below

All commands associated with Keeper Secrets Manager

Command
Explanation
secrets-manager app create
Create an application
secrets-manager app get
Display information about a specified application
secrets-manager app remove
Remove an application
secrets-manager app list
List all applications
secrets-manager share add
Add secrets (records or shared folder) to an application
secrets-manager share remove
Remove secrets (records or shared folder) from an application
secrets-manager client add
Add client to an application
secrets-manager client remove
Remove a client from an application

secrets-manager app create command

Command: secrets-manager app create
Detail: Create a new application that will be used to link clients to secrets
Parameters:
Name of the application
Example:
My Vault> secrets-manager app create PythonApp
Application was added successfully

secrets-manager app get command

Command: secrets-manager app get
Detail: Display information about a specified application
Parameters:
Name or UID of the application
Examples:
My Vault> secrets-manager app get PythonApp
​
Secrets Manager Application
App Name: PythonApp
App UID: ji__hxgaY3xvQdefVY_ffA
​
Client Device 1
=============================
Name: Device1
Short ID: nWThUIbR
Created On: 2021-10-11 16:26:21
First Access: 2021-10-11 16:27:05
Last Access: 2021-10-11 16:49:47
IP Lock: Disabled
IP Address: --
​
Application Access
Share Type UID Title Permissions
------------ ---------------------- ---------------------- -------------
FOLDER J62WIXgJwMqIyYJL7kd3xw Secrets Editable
RECORD mux0ZaWKd-vpmaggFzLkrw Database Login Read-Only

secrets-manager app remove command

Command: secrets-manager app remove
Detail: Remove an application
Parameters:
Name or UID of the application
Examples:
My Vault> secrets-manager app remove PythonApp
​
This Application (uid: 2lj-PaoQp281mTV7GWK5Bw) has 5 client(s), 1 shared folder(s), and 10 record(s).
Are you sure you want to delete this application [y/n]: >? y
>? y
Removed Application uid: 2lj-PaoQp281mTV7GWK5Bw
​
My Vault> secrets-manager app remove KtU4eAzor5IpqRW3x4A8FA
This Application (uid: KtU4eAzor5IpqRW3x4A8FA) has 12 client(s), 1 shared folder(s), and 4 record(s).
Are you sure you want to delete this application [y/n]: >? y
>? y
Removed Application uid: KtU4eAzor5IpqRW3x4A8FA
​

secrets-manager app list command

Command: secrets-manager app list
Detail: List all created applications
Example:
My Vault> secrets-manager app list
​
List of all Applications
​
Title Uid
--------- ----------------------
PythonApp oXMfwo-hzZNRqMXGvJlccQ
TestApp KtU4eAzor5IpqRW3x4A8FA
​

secrets-manager share add command

Command: secrets-manager share add
Detail: Add secret (record or shared folder) to an Application
Switches:
--secret , -s <SECRET'S UID> secret to share. can be folder or record UID
--app, -a <APPLICATION RECORD UID> application to share with
--editable, -e Allow edits to the records
Examples:
My Vault> secrets-manager share add --app PythonApp --secret="-XMfwo-hzZNRqMXGvJlccQ"
Successfully added new record uid=E7YS6Yqmhsip52DzwdC9gw to app uid=oXMfwo-hzZNRqMXGvJlccQ

secrets-manager share remove command

Command: secrets-manager share remove
Detail: Remove secret (record or shared folder) from an Application
Switches:
--secret , -s <SECRET'S UID> secret to share. can be folder or record UID
--app, -a <APPLICATION RECORD UID> application to share with
Examples:
My Vault> secrets-manager share remove --app PythonApp --secret="-XMfwo-hzZNRqMXGvJlccQ"
Secret share was successfully removed from the application

secrets-manager client add command

Command: secrets-manager client add
Detail: Add a Client to an Application that will be used to connect to the application. The output of this command is a one-time token which is used for initializing the Client device through the Secrets Manager SDK.
Switches:
--name [CLIENT NAME] : Name of the client (Default: Random 10 characters string)
--first-access-expires-in-min [MIN] : First time access expiration (Default 60, Max 1440)
--access-expire-in-min [MIN] : Client access expiration (Default: no expiration)
--unlock-ip : Does not lock IP address to first requesting device
--count [NUM] : Number of tokens to generate (Default: 1)
--config-init [json, b64 or k8s] : Initialize configuration string from a one-time token
--name [NAME] name of the client
Example 1: Create a new device called "Test 1" and produce a One Time Access Token.
My Vault> sm client add --app Ansible --name "Test 1"
​
Successfully generated Client Device
====================================
One-Time Access Token: US:_wYNCeeLmBSdDgkcE77NyMcO-6DqLutNO1NylWVyco
Name: Test 1
IP Lock: Enabled
Token Expires On: 2021-09-30 22:52:46
App Access Expires on: Never
​
Example 2: Create a new device called "Test 2" and produce a fully initialized JSON config file without IP lock. This config file can be loaded into a device directly.
My Vault> sm client add --app Ansible --name "Test 2" --unlock-ip --config-init=json
​
Successfully generated Client Device
====================================
​
Initialized Config: {"hostname": "keepersecurity.com","clientId": "XXX","privateKey": "XXX","serverPublicKeyId": "10","appKey": "XXX"}
Name: Test 2
IP Lock: Disabled
Token Expires On: 2021-09-30 22:54:11
App Access Expires on: Never
Example 3: Create a new device called "Test 3" and produce a fully initialized base64 config string without IP lock. This config file can be loaded into a device as a single string instead of using a JSON config file.
My Vault> sm client add --app Ansible --name "Test 3" --unlock-ip --config-init=b64
​
Initialized Config: eyJob3N0bmFtJjbGllbnRJZCI6I3lHbXZodUZFITEhBbDhBRmVHK1owSDcrN2czOVMvNGkvTU1lcVhhVi92cTc4S3FqM2VuZkdtQkQzNmhsQT09IiweXFHU000OUFnRUdDQ3FHU000OUF3RUhCRzB3YXdJQkFRUWdqN2diVXM2bXVl0bXA0WjlnR0ttaFJBTkNBQVNrdTZCN3dPclpXSGdhR1lzNE1uRGNyZE5xdXYyRkYmNQWTF3S090ZHppME03c05PTnA4cXppU0VLejhUUGVTIiwic2VydmVyUHVibGljS2V5SWQiOiAiMTAiLCJhcHBLZXkiOiAiUFlqdlcrVTqdUljdUh6UzJHcz0ifQ==
Name: Test 3
IP Lock: Disabled
Token Expires On: 2021-09-30 22:59:09
App Access Expires on: Never
Example 4: Create a new device called "Test 4" and produce a fully initialized Kubernetes config without IP lock. The YAML output can be cut-n-pasted into a file and applied to create as a Kubernetes secret.
My Vault> sm client add --app Nginx --name "Test 4" --unlock-ip --config-init=k8s
​
apiVersion: v1
data:
config: eyJob3N0bmFtJjbGllbnRJZCI6I3lHbXZodUZFITEhBbDhBRmVHK1owSDcrN2czOVMvNGkvTU1lcVhhVi92cTc4S3FqM2VuZkdtQkQzNmhsQT09IiweXFHU000OUFnRUdDQ3FHU000OUF3RUhCRzB3YXdJQkFRUWdqN2diVXM2bXVl0bXA0WjlnR0ttaFJBTkNBQVNrdTZCN3dPclpXSGdhR1lzNE1uRGNyZE5xdXYyRkYmNQWTF3S090ZHppME03c05PTnA4cXppU0VLejhUUGVTIiwic2VydmVyUHVibGljS2V5SWQiOiAiMTAiLCJhcHBLZXkiOiAiUFlqdlcrVTqdUljdUh6UzJHcz0ifQ==
kind: Secret
metadata:
name: ksm-config
namespace: default
type: Opaque
​
Name: Test 4
IP Lock: Disabled
Token Expires On: 2021-09-30 22:59:09
App Access Expires on: Never

secrets-manager client remove command

Command: secrets-manager client remove
Detail: Remove a client from an Application
Switches:
--client <CLIENT ID> client to remove from the application
--app, -a <APPLICATION RECORD UID> application
--force don't ask for approval
Examples:
My Vault> secrets-manager client remove --app PythonApp --client MyClient
Are you sure you want to delete 3 matching clients from this application? [y/n]:
>? y
Client removal was successful
Previous
SFTP Sync
Next
MSP Management Commands
Last modified 1yr ago