.env files that contain plaintext variables. Developer Watchtower will alert you about secrets that don’t follow best practices, so you can mitigate secrets risk and improve the security of your workflow.
1Password only looks for developer secrets in defined locations on your local disk. Secret values are never collected or revealed, and no one at 1Password can see or access your data.
Requirements
Before you can use Developer Watchtower, you’ll need to:- Sign up for 1Password.
- Install and sign in to 1Password for Mac, Windows, or Linux.
Step 1: Turn on local disk scanning
- In the 1Password desktop app, select Developer in the sidebar, then select View Watchtower.
- Choose the types of secrets you want 1Password to check for:
- Select SSH keys to scan your
~/.sshdirectory for insecure and unencrypted SSH keys. - Select .env files to scan your local disk for
.envfiles that contain plaintext secrets.
- Select SSH keys to scan your
.env files in Developer Watchtower.
If you use 1Password as part of an organization, local disk scanning may be controlled by an account policy.You can go to Settings > Developer > Watchtower to check if there’s a message that local disk scanning is managed by your organization. Contact your administrator to learn more.
Step 2: View your results and remediate issues
After local disk scanning is turned on, Developer Watchtower will list any SSH keys and.env files found on disk, according to your settings. Then you can remediate any issues.
Take action on SSH key alerts
SSH key alerts are listed according to the attributes with the highest security impact. To act on an alert:- Select an SSH key item in the list to see more information about the issue.
- Select the down arrow to the right of the item to see a list of available actions.
- Remediate issues based on the type of alert for each key.
Learn more about how SSH key scanning works.
Import plaintext secrets from local .env files
Developer Watchtower only supports importing and mounting local
.env files on Mac and Linux at this time. Windows support is coming soon..env files it finds on disk that contain plaintext secrets. You can then import those secrets into new or existing 1Password Environments and choose if you want to mount your .env files.
Use the following steps to import plaintext secrets from local .env files into 1Password:
- In the 1Password desktop app, select Developer in the sidebar, then select View Watchtower.
-
Select an item in the list to see more information about the project secrets and variables in the
.envfile. - Select Import on an item to import the secrets into 1Password.
-
Choose if you want to import your environment secrets into a new or existing environment and if you want to mount the file:
- Select New environment to create a new 1Password Environment. Enter a name for the environment and select the 1Password account you want to save the environment in.
- Select Existing environment if you already have a 1Password Environment you want to import the secrets into. Choose your environment from the list.
- Select Import environment.
.env file. If you also mounted the environment file, 1Password will replace the plaintext .env file on disk with a locally mounted .env file at the same path.
Learn more about how .env file scanning works.
About SSH key scanning
Developer Watchtower scans your$HOME directory for SSH keys in the following location and formats:
1Password doesn’t follow symlinks or traverse file systems (for example, an external drive mounted at
~/.ssh/other will be skipped). Files over 1 MiB (mebibyte) in size are also skipped.
If any SSH keys are found within these parameters, they’ll be added to Developer Watchtower to alert you to security issues and provide recommendations to improve your SSH key management.
Ignore files
If you want 1Password to ignore specific files when checking for developer secrets, you can create a.ignore file in your SSH folder. Then add entries to the ~/.ssh/.ignore file to specify which files 1Password should ignore. For example:
Example entries in ~/.ssh/.ignore file
SSH key alerts
Insecure key type
An insecure SSH key is a critical security issue that needs to be addressed. Insecure keys are vulnerable to being cracked, which can provide attackers with the ability to infiltrate and compromise servers. Insecure keys include:- DSA keys
- RSA keys less than 2048 bits in strength
authorized_keys file of every server it’s used with.
First, remove the insecure key from the authorized_keys file of every server, or from any service, where it’s used. Next, generate a new, secure SSH key in 1Password and use the new key to replace the insecure key anywhere it was used. Then, in Developer Watchtower, select the action menu for the insecure key and choose Delete SSH key from disk to permanently remove the key from disk.
Unencrypted key
A private key file stored in plaintext is a security vulnerability and provides an easy target for malware. Encrypting your SSH private keys with passphrases provides another layer of protection and is a common practice supported by SSH clients. If Developer Watchtower alerts you to an unencrypted key on your local disk, you can choose one of the following options from the action menu:- Import: When you import an SSH key into 1Password, it’s automatically encrypted for you. After you import the key into 1Password, you can permanently remove the redundant copy from your disk. Select the action menu for the unencrypted key in Developer Watchtower and choose Delete SSH key from disk.
-
Copy Encryption Command: If you prefer to keep a copy on disk, you should encrypt the key file with a passphrase. This option copies the
ssh-keygencommand to your clipboard, including the path to your key. You can run the command in your terminal app:The-pfflag prompts you to create a passphrase and specify the private key file you want to encrypt.
Import into 1Password
Storing your SSH keys in 1Password allows you to securely authenticate all your Git and SSH commands from 1Password using the 1Password SSH Agent. Your private keys never leave 1Password, are never stored locally, and are never used without your consent. Learn more about 1Password SSH Agent security. If Developer Watchtower detects an SSH key that is both encrypted and a supported key type, you can import the key into 1Password. Select the down arrow on the right of the item, then select Import. After you import the SSH key, you can remove the redundant copy of the key from your local disk.Already exists in 1Password
1Password compares the public fingerprint of the SSH key on your local disk with the fingerprints of your SSH Key items in 1Password to determine if you’ve already saved the key there. If Developer Watchtower indicates that a key in your local~/.ssh folder has already been saved 1Password, you can remove the redundant copy of the SSH key on disk. Select the item’s action menu and choose Delete SSH key from disk to permanently remove the key from disk.
Unsupported key
An SSH key that isn’t supported in 1Password can’t be imported. Check the list of supported SSH key types for more information. If Developer Watchtower lets you know that a key on your local disk is unsupported, consider generating a new SSH key if you want to use it with the 1Password SSH Agent. You may also be able to convert some keys to a format 1Password does support. For example, 1Password doesn’t support keys in the PuTTY format (.ppk), but PuTTYgen lets you export your PPK keys into the OpenSSH format, which is supported.
About .env file scanning
Developer Watchtower scans your $HOME directory for .env files that contain plaintext secrets in the following locations:
~/code~/dev~/Developer
~/git~/projects~/Projects
~/repos~/src~/work
^\.env(\..+)?$ pattern, such as .env, .env.local, or .env.production.
1Password only provides alerts for .env files that contain values likely to be sensitive, like API keys or tokens. The following files aren’t surfaced:
- Files that contain only non-sensitive values, such as
NODE_ENV=development. - Files whose values are already managed by 1Password.