A "Swiss Army Knife" command-line interface (CLI) for easy human and non-human interaction with CyberArk suite of products. Products supported include Identity Security Platform Shared Services (ISPSS), Privilege Cloud (PCloud), Self-Hosted Privilege (PAM), Central Credential Provider (CCP), Conjur Secrets Manager, and Cloud Entitlments Manager (CEM).
Cybr-cli is a command-line interface (CLI) tool designed to facilitate interaction with CyberArk's suite of products. It serves as a versatile tool for both human users and automated systems, enabling seamless integration and management across various CyberArk solutions.
Enables password management, safe administration, and auditing operations.
Provides support for different authentication methods including password-based, multi-factor authentication (MFA), and AWS IAM role-based authentication.
Audience & Benefit:
Ideal for DevOps engineers, security teams, and organizations utilizing CyberArk products. Cybr-cli enhances operational efficiency by automating routine tasks and providing a unified interface for managing CyberArk resources. It streamlines integration with existing workflows and systems, reducing manual intervention and potential errors.
Installable via winget for Windows users, cybr-cli offers flexibility and ease of use across different environments.
CONJUR_AUTHN_LOGIN - The Host ID for the IAM role (e.g. host/cloud/aws/ec2/1234567890/ConjurAWSRoleEC2)
CONJUR_AUTHENTICATOR - The authenticator ID (e.g. authn-iam)
CONJUR_AUTHN_SERVICE_ID - The authenticator web service ID (e.g. prod)
CONJUR_AWS_TYPE - The AWS type (e.g. ec2 or ecs or lambda)
Once environment variables are set, ensure no .conjurrc or .netrc exists in the user's home directory:
rm -f ~/.conjurrc ~/.netrc
Then run any command you wish to run within cybr conjur. Use the --help flag to see all available commands.
Authenticating to Privilege Cloud via ISPSS (Identity)
You will need to know the following information to authenticate to Privilege Cloud via ISPSS:
* -b, --base-url - The base URL of CyberArk Cloud (e.g. https://example.cyberark.cloud or https://example.privilegecloud.cyberark.cloud)
* -u, --username - The username of the Privilege Cloud user (e.g. joe.garcia@cyberark.cloud.1234)
Password Authentication
$ cybr logon -u joe.garcia@cyberark.cloud.1234 -a identity -b https://example.cyberark.cloud
+ Challenge #1
Enter password:
After providing the password, if no other challenges are required, the CLI will handle the token exchange and a successful logon will be displayed.
MFA Authentication
If MFA is required, the CLI will prompt for the challenge method to use out of those available:
$ cybr logon -u joe.garcia@cyberark.cloud.1234 -a identity -b https://example.cyberark.cloud
+ Challenge #1
Enter password:
+ Challenge #2
1. Email... @joe-garcia.com
2. SMS... XXX-1234
> 2
Enter code: 12341234
After providing the MFA code, if no other challenges are required, the CLI will handle the token exchange and a successful logon will be displayed.
The cybr CLI has a completion command that can be used to enable autocomplete for the CLI.
The completion command is dependant on your shell type. Currently the only shells that are supported are: bash, zsh, fish and powershell.
Below is an example on how to enable cybr cli auto-completion from a zsh shell.
# enable shell completetion. Only needs to be performed once.
echo "autoload -U compinit; compinit" >> ~/.zshrc
# create and write the auto-completion script.
# ${fpath[1]} '1' may be different depending on your environment.
cybr completion zsh > "${fpath[1]}/_cybr"
If you are using a different shell execute the completion command with the --help flag and follow instructions for the desired shell type.
cybr completion --help
Example Source Code
Logon to the PAS REST API Web Service
package main
import (
"fmt"
"log"
"os"
pasapi "github.com/infamousjoeg/pas-api-go/pkg/cybr/api"
)
var (
hostname = os.Getenv("PAS_BASE_URL")
username = os.Getenv("PAS_USERNAME")
password = os.Getenv("PAS_PASSWORD")
authType = os.Getenv("PAS_AUTH_TYPE")
)
func main() {
// Logon to PAS REST API Web Services
token, errLogon := pasapi.Logon(hostname, username, password, authType, false)
if errLogon != nil {
log.Fatalf("Authentication failed. %s", errLogon)
}
fmt.Printf("Session Token:\r\n%s\r\n\r\n", token)
}
Security
If there is a security concern or bug discovered, please responsibly disclose all information to joe (dot) garcia (at) cyberark (dot) com.
cybr safes add-member --role Role Permissions
All safe member roles defined below are based on best practices and recommendations put forth by CyberArk's PAS Programs Office, creators of the CyberArk Blueprint for Identity Security.
Role
Safe Authorizations
BreakGlass
All authorizations except Authorize Password Requests
VaultAdmin
- List Accounts- View Audit Log- View Safe Members
