Securely Erase Remote Servers

Kyle Rankin

Sr. Systems Administrator

Cyan Inc.

Author of The Official Ubuntu Server Book, Ubuntu Hacks, and Knoppix Hacks

http://greenfly.org/talks/security/secure_wipe.html

Agenda

• The Problem
• Why
• How
• A Few Precautions
• Secure Drive Wiping
• Shutdown without /sbin/shutdown
• Questions

The Problem

• Decommission an old server
• Securely delete all data
• Power off the machine afterwards
• Without remote console
• Without remote power
• All over ssh

Why

• VGA/KVM/physical access doesn't work
• Locked out from your server
• Consulting client
• Cloud server without good tools
• Evil malicious destructive hacker covering his tracks

How

• No redos
• Rely heavily on RAM
• Prepare a few backups
• Run secure wipe command
• Trigger a kernel shutdown

A Few Precautions

• Use /dev/shm
• Mount a backup of proc in /dev/shm:

mkdir /dev/shm/proc
mount -t proc proc /dev/shm/proc

• Copy /bin/echo to /dev/shm
• Heck, copy /bin, /sbin, and /lib if you can
• None of this is actually necessary

Secure Drive Wiping

• Point of no return
• Run shred on every hard drive
• Should be installed by default
• Choose non-root drives first
• The command to overwrite 2x + zeroes on /dev/sda:

shred -n2 -z -v /dev/sda

• Adjust -n to your level of paranoia

Shutdown without /sbin/shutdown

• Use /proc
• First enable the sysrq interface in the kernel:

echo 1 > /proc/sys/kernel/sysrq

• Then to halt:

echo o > /proc/sysrq-trigger

• To reboot instead:

echo b > /proc/sysrq-trigger

Questions?

• http://greenfly.org/talks/security/secure_wipe.html