YubiKey at Datadog
Notice: This code repository is no longer maintained or updated. The content and code are provided as-is, and may no longer be relevant or functional.
For Datadog employee, see the “commit signing setup guide” in Confluence instead_
GPG is useful for authenticating yourself over SSH and / or GPG-signing your
git commits / tags. However, without hardware like the
YubiKey, you would
typically keep your GPG private subkeys in “plain view” on your machine, even
if encrypted. That is, attackers who personally target
[1,
2,
3,
4] you
can compromise your machine can exfiltrate your (encrypted) private key, and
your passphrase, in order to pretend to be you.
Instead, this setup lets you store your private subkeys on your YubiKey.
Actually, it gives you much stronger guarantees: you cannot authenticate over
SSH and / or sign GPG commits / tags without: (1) your YubiKey plugged in and
operational, (2) your YubiKey PIN, and (3) touching your YubiKey. So, even if
there is malware trying to get you to sign, encrypt, or authenticate something,
you would almost certainly notice, because your YubiKey will flash, asking for
your attention. (There is the “time of check to time of
use“ issue,
but that is out of our scope.)
About 2-3 hours. 15 minutes could save you 15% or more on cybersecurity
insurance.
You will need macOS with Homebrew / Ubuntu / Archlinux, a password manager, and a
YubiKey 5.
STRONGLY recommended: configure U2F for
GitHub
and
Google.
Please read and follow all of the instructions carefully.
$ ./gpg.sh
(Protip: set TEMPDIR=1 when preparing YubiKey for someone else to avoid
polluting your default GPG homedir.)
STRONGLY RECOMMENDED: signing your git commits and tags.
You must first set up GPG.
Then, to sign git commits and tags for a particular repository:
$ ./git.sh /path/to/git/repository
Or, to sign git commits and tags for all repositories:
$ ./git.sh
NOT recommended for most users. This script sets up your YubiKey as the holder of your SSH key,
helping to prevent it from being leaked or stolen. The script will take control of ssh-agent, so
it’s not particularly compatible with other SSH keys - you should only run this if you intend to use
this as your only SSH key on the machine you’re using.
With this setup, you’ll need to enter a PIN to unlock the key every 24 hours and then physically touch the
key when it blinks (i.e. every time you SSH or push/pull Git). If you don’t touch the key, the request will
timeout and you’ll get an unhelpful message.
This is compatible with usage on remote machines over SSH
(it will set up agent forwarding to use the key remotely; touch is required on each action).
You must have first set up GPG. Then:
$ ./ssh.sh
If you need to reset YubiKeys, you may use the following script. The script looks for every plugged YubiKey,
and shows a menu to reset one specific key, or all of them.
Please read and follow all of the instructions carefully. YOU WILL NOT BE ABLE TO RETRIEVE KEYS/DATA FROM THE YUBIKEY AFTER COMPLETION.
$ ./reset.sh
Go here for troubleshooting common issues such as unblocking a blocked card, error when pulling or pushing with git over SSH, and rebasing with git.
Go here for support on optional bits such as configuring a computer to use an already configured YubiKey, signing for different git repositories with different keys, Keybase, VMware Fusion, and Docker Content Trust.