3 ms·

Question for fellow paranoid HNers: what do you use to decommission a server? Do you run shred(1) on all "interesting" files? Do you write over the block device

by sigil 13y ago

Question for fellow paranoid HNers: what do you use to decommission a server? Do you run shred(1) on all "interesting" files? Do you write over the block device itself with random data?

nixgeek 13y ago
Physical server or virtual server? In the latter case (virtual servers, or containers) you have almost no real guarantees that shred(1) or friends will be effective, because you likely have no idea how the provider is implementing storage under the covers. Therefore you are entirely reliant on them, this opacity is a serious issue in the industry (IMO) and even worse is when you are told to expect one behaviour and encounter another! It's not all that uncommon for physical servers to have their drives pulled and then subjected to a three-stage destruction process wherein they are first degaussed, then thrown into a "shearing" device which cuts them up into more manageable chunks before being "shredded" into fairly small chunks. There are all kinds of standards for drive destruction but I know some units can output nothing larger than 0.75" x 1" chunks which coupled with degaussing is probably "very fatal". Data destruction in this manner is required in many government applications (usually depends on the Impact Level) and most large corporations have fairly rigid policies governing how data (and the things used to store it) are destroyed once they are no longer useful. Erasing data properly from NAND is seriously difficult so even things like shred(1) are not guaranteed to work. Writing over the block device from within the OS also may not get it all because of the firmware doing interesting things (i.e. wear-leveling) however it is thankfully still vulnerable to being bashed with a hammer or shredded.
rdl 13y ago
A quick pass of bcwipe/shred/etc. just to make them less sensitive during transport, and physical destruction of drives. I pretty much just store the drives until I get enough of them and then angle grinder fun, or, if I have someone paying for it, a commercial drive destruction service (and if they let me, I throw personal drives in at the same time, since it's usually no marginal additional cost). I haven't owned SSDs long enough to need to destroy any, but some physical destruction is the only way. I do use full disk encryption on drives and then repurpose machines by changing the full disk encryption keys, but those machines haven't left my control -- it's just for changing e.g. a photo drive to a movie drive. I'd be a bit conflicted if I were buying FusionIO or high end SSDs, but I generally buy 1) fast/big consumer SSDs and 2) big spinning drives, and keep both in service until they're essentially valueless. IMO, degaussing is probably a good solution in a high volume environment as an early step, but it's not as good as physical destruction, and it wrecks the drive, so you really need physical destruction. I dream of having an office with wet lab, machine shop, private SCIF/VTRs and a destruction facility with soundproofing.
ars 13y ago
You don't need shred. A simple zeroing of the data works fine. The badblocks program from e2fsprogs works very nicely (and is often installed already on bootable linux images): badblocks -s -t 0x00 -w -v /dev/foo I would not shred only interesting files, with journaling file systems (the default these days) you can't really tell for sure where your data ended up.

by sigil 13y ago

Question for fellow paranoid HNers: what do you use to decommission a server? Do you run shred(1) on all "interesting" files? Do you write over the block device itself with random data?

nixgeek 13y ago

Physical server or virtual server? In the latter case (virtual servers, or containers) you have almost no real guarantees that shred(1) or friends will be effective, because you likely have no idea how the provider is implementing storage under the covers. Therefore you are entirely reliant on them, this opacity is a serious issue in the industry (IMO) and even worse is when you are told to expect one behaviour and encounter another! It's not all that uncommon for physical servers to have their drives pulled and then subjected to a three-stage destruction process wherein they are first degaussed, then thrown into a "shearing" device which cuts them up into more manageable chunks before being "shredded" into fairly small chunks. There are all kinds of standards for drive destruction but I know some units can output nothing larger than 0.75" x 1" chunks which coupled with degaussing is probably "very fatal". Data destruction in this manner is required in many government applications (usually depends on the Impact Level) and most large corporations have fairly rigid policies governing how data (and the things used to store it) are destroyed once they are no longer useful. Erasing data properly from NAND is seriously difficult so even things like shred(1) are not guaranteed to work. Writing over the block device from within the OS also may not get it all because of the firmware doing interesting things (i.e. wear-leveling) however it is thankfully still vulnerable to being bashed with a hammer or shredded.

rdl 13y ago

A quick pass of bcwipe/shred/etc. just to make them less sensitive during transport, and physical destruction of drives. I pretty much just store the drives until I get enough of them and then angle grinder fun, or, if I have someone paying for it, a commercial drive destruction service (and if they let me, I throw personal drives in at the same time, since it's usually no marginal additional cost). I haven't owned SSDs long enough to need to destroy any, but some physical destruction is the only way. I do use full disk encryption on drives and then repurpose machines by changing the full disk encryption keys, but those machines haven't left my control -- it's just for changing e.g. a photo drive to a movie drive. I'd be a bit conflicted if I were buying FusionIO or high end SSDs, but I generally buy 1) fast/big consumer SSDs and 2) big spinning drives, and keep both in service until they're essentially valueless. IMO, degaussing is probably a good solution in a high volume environment as an early step, but it's not as good as physical destruction, and it wrecks the drive, so you really need physical destruction. I dream of having an office with wet lab, machine shop, private SCIF/VTRs and a destruction facility with soundproofing.

ars 13y ago

You don't need shred. A simple zeroing of the data works fine. The badblocks program from e2fsprogs works very nicely (and is often installed already on bootable linux images): badblocks -s -t 0x00 -w -v /dev/foo I would not shred only interesting files, with journaling file systems (the default these days) you can't really tell for sure where your data ended up.