"sanitizing" disks: wiping swap, non-allocated space, and file-tails

[Brooks Davis]

[Please don't cross post so much.]

On Fri, Jul 16, 2004 at 05:22:53AM +0100, David Kreil wrote:
> to avoid leakage of sensitive information: any advice?
> From: David Kreil <kreil at puffin.ebi.ac.uk>
> 
> (1) I was wondering whether anyone knew of packages/tools to aid in 
> "sanitizing"
> a FreeBSD system, i.e., wiping
>   + the swap slice
>   + non-allocated space on volumes
>   + "file-tails" (the part of the last allocated block of files not used)
> with random patterns to avoid leakage of sensitive information (plain text 
> keys or decrypted texts).
> 
> I am aware of the security limitations of any approach that does not involve 
> dissolving the entire disk in acid etc but would be grateful for a pointer to 
> a tool that at least
>  + generates reasonably random data for its writes
>  + ideally does a reasonable effort of turning off caching whereever it could
>    (ideally in the file system, the disk driver, and the disk itself)
>    or alternatively at least did the overwrites in such an order that the
>    effect of caching would be minimized.
> 
> If there are no "tools", would you know whether I can get FreeBSD on shutdown 
> to stop using swap and access it as a raw disk device that I can write to, and 
> how to hook into the shutdown process?

The only way to clean a file system I can think of is, to dump the fs,
scrub the disk, restore the fs.  That will keep only real data and
remove all the junk.  You should be able to scrub swap at shutdown if
you use swapoff to disable it, but you've got to be sure it's all unused
first.  You can't trust this though because you don't know the system
will shut down cleanly.

There is a currently null operation in the disk code that acts when
a block is no longer used.  It should be possible to hook into that
code to implement some sort of scrubber.  It wouldn't be reliable for
the same reason that a swap scrubber can't be, but it would be OK most
of the time.

The easiest way to scrub a disk is:

dd if=/dev/random of=/dev/<disk> bs=<something big>
<repeat a few times>
dd if=/dev/zero of=/dev/<disk> bs=<something big>

This doesn't meet DoD requirements, but only for obsolete reasons.

> (2) Related to this:
> 
> I'm also interested in people's personal experiences in using partition or 
> file system encryption options.
> 
> For performance reasons I'd rather avoid having /tmp and swap and certain work 
> space on an encrypted disk, hence the need for (1).

If you swap, your performance will be suck enough that encrypting it
won't hurt much, especially with modern CPUs.  I wouldn't worry at all
about that cost.  /tmp is probably similar for most applications.

-- Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20040715/4a3d59aa/attachment.bin