Troubleshooting
In the event that our unquestionably perfect code fails to run here are some things to try...
Record UIDs are randomly generated and sometimes begin with the '-' (hyphen) character. When this happens, it prevents Commander CLI from recognizing the UID as a UID value.
To use UIDs in a positional parameter that begin with '-' add '--' before the UID.
Example:
get -- -UREsVJNP7vU-KTyZ3YF9A
Commander CLI will then recognize the UID without confusing it for a command switch. In this case, it will search for a record with the UID
-UREsVJNP7vU-KTyZ3YF9APairing UIDs that begin with '-' with additional command switches
If you plan on pairing the UID with additional command switches, then the UID needs to be placed after all the command switches. In other words, the UID needs to placed as the last positional parameter.
Example:
get --format json -- -UREsVJNP7vU-KTyZ3YF9A
Using UID that begins with '-' as an argument
If you need to use the UID as an argument for a command flag, there is instead a different format.
To do this, add "=" after the flag, and wrap the UID in quotation marks.
Example:
secrets-manager share add --app TestApp --secret="-fwZjKGbKnZCo1Fh8gsf5w"
When using Commander you may encounter references to typed vs untyped or V2 vs V3 records. There are a few fundamental differences between these records which cause them to interact differently in some aspects of the platform.
Records which have a record type are considered 'typed' or sometimes referred to as 'V3'. These records have a malleable structure which can be defined and customized as well as an updated encryption model with heightened security.
Older records which were created before the release of record types are called 'untyped', 'legacy' or 'V2' records. These records have a set structure with a login, password, url, totp, and file attachment field (as well as notes). Any other fields must be added as custom fields to the record.
In Commander, when you view the details of a record with the
get command, Typed records will always show a type field, while Legacy records will have no type field at all.Typed Record
My Vault> get uxRrj[...]ZAM0bSQ
UID: uxRrj[...]ZAM0bSQ
Type: databaseCredentials
Title: LastPass Database
Notes: LP DB Notes
type (text): SQL
(host): hostName | 3030
(login): SQL_Admin
Database (text): MyDB
Legacy Record
My Vault> get 4XjSH[...]Gy1LAEg
UID: 4XjSH[...]Gy1LAEg
Title: My Record
Login: Login
Password: Password
Additionally, the
ls -l command shows records in a list with type as one column. Any record with a value in that field is typed, and any record with no value is legacy.My Vault> ls -l
# Record UID Type Title Login URL
--- ------------- ------------------- ----------------------- ------------------------- -----------------------------------
1 V[...]w login Typed MyLogin example.com
2 q[...]A Legacy MyLegacyLogin legacy.com
Text | Legacy | Typed |
|---|---|---|
Names | Legacy, Untyped, V2 | Typed, V3 |
Fields | Set (login, password, url, totp, files, notes) | Customizable by type |
Type Value
( get [UID] command ) | empty (No type field) | Type: type value
e.g. 'login' |
You may encounter the following error message when attempting to perform an action with Commander:
You do not have the required privilege to perform this operation
The message indicates that the current logged in account does not have permission to perform the requested action.
Many Commander commands require some form of permission policy to be enabled. When relevant, the documentation should indicate when a permission is required to use a command.
There are three main permission types that can lead to this message.:
Keeper roles can specify permissions allowed for all users in that role. For example a role can determine if users can share records or use Keeper Secrets Manager. When a user has multiple roles, the most restrictive permissions apply.
Read more about Role Enforcement Polices in the docs:
Keeper administrators have access to account-level actions and features which can be turned off and on with these permission policies. These include things like running compliance reports.
Read more about Administrative Permissions in the docs:
Some features require an additional add-on to be used. These include features such as Keeper Secrets Manager and the Advanced Reporting and Alerts Module which is required to run custom reports. Secure add-ons can be managed in the Secure Add-Ons section of the Keeper Admin Console.
Read more about managing add-ons in the docs:
Dependency issues are the most common problem, so please make sure you have an updated version of Python 3 installed.
C:\>pip3 --version
Validate WinPython is correctly installed by checking the installed version from launching the "WinPython Command Prompt" in the installation folder:
MacOS ships with a default python installation that is too old and unsupported. A current version of Python needs to be installed
Depending on your operating system security settings you may need to "Allow" the application to run or install. To do this open "System Preferences" > "Security and Privacy" > "General" tab
Validate Python is correctly installed by checking the installed version from a terminal window:
$ pip3 --version
Don't run the below, it'll report the older version of python:
$ --version
Summary security audit scores, as a result of the way they are independently calculated (while using different algorithms, no less) on the admin-side -- usually via the admin console web UI -- and on the vault-side -- e.g., via web vault UI, can become mis-aligned and consequently need correcting.
As this is the surest and most straight-forward way to perform summary security scores-alignment (also known as a hard-sync), we will run the following process (which will require the participation of each of the affected vault owners and at least one admin -- all of which will entail each participant installing and running the latest version of Commander, instructions for which can be found here):
Note: Prior to performing the following steps (in the indicated order), please make sure all instances of the admin console app are closed
I. As the vault owner:
- 1.login to Commander (if the user is already logged in to Commander, log out and log back in, or run
sync-downto ensure they have the latest vault data) - 2.in Commander, run the following:
sync-security-data --hard
II. As an admin:
- 1.login to Commander
- 2.in Commander, run the following:
security-audit-report --save
Only after the above steps have been completed for all affected users can the admin then re-open the admin console UI to check if the scores align with the scores shown in the user's vault.
Please note: the method above is just 1 of various ways we can perform a hard-sync of admin and vault summary security scores. For instance, in lieu of using Commander and performing the relevant step(s) -- as shown in the directions above -- for each vault owner, our beta site's "Security Data Hard-Sync" feature (which is likely found here for most users -- check the URL for possible necessary modifications for your assigned region) could be used by each vault owner instead (probably best done with recently-updated vault data, i.e., clear vault cache prior to hard-sync if possible), thus obviating the need to install and use Commander for each affected vault owner.
When running Commander or related Keeper SDK code, if you receive SSL certificate errors such as:
Certificate validation error. More info:
https://docs.keeper.io/secrets-manager/commander-cli/using-commander/troubleshooting-commander-cli#ssl-certificate-errors
or
requests.exceptions.SSLError: HTTPSConnectionPool(host='keepersecurity.com', port=443): Max retries exceeded with url: /api/rest/authentication/get_device_token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)')))
If you receive this message, please make sure that your network is not attempting to do packet inspection with a proxy. Due to our advanced encryption, Keeper traffic cannot be intercepted by a network proxy device. Consult with your IT team to allow traffic to keepersecurity.[com|eu|com.au] on the firewall outbound.
Keeper has partnered with Bugcrowd to manage our vulnerability disclosure program. Please submit reports through https://bugcrowd.com/keepersecurity or send an email to [email protected].
Last modified 20d ago