Canary Credentials

A fake key on disk that has no use except one: if it ever turns up in a command or a reply, something read the file it was in.

Every other control here answers "should this be allowed". A canary answers a different question: it tells you a read already happened, no matter which path it took to happen. The value is worthless to whoever took it and conclusive to you.

Plant

node9 canary plant

Creates decoy credential files. It never modifies a file that already exists, so nothing real is overwritten.

Check

node9 canary status

Which decoys are planted and whether their files are still on disk. A decoy someone deleted is worth knowing about.

Removing one does not stop it working

node9 canary remove
node9 canary rotate

remove deletes the files node9 created, and refuses if a file changed since it was planted. The value stays recognised afterwards: a decoy that leaked before you removed it is still detected when it surfaces. rotate replaces the values and retires the old ones the same way.

Canary Credentials · node9 documentation

Canary Credentials