MAAS does not securely wipe nodes between provisioning

[Dustin Kirkland ]

Heard from a customer today. MAAS needs an option to securely wipe nodes' disks in between provisioning. A dd of /dev/zero to the entire disk would suffice. The goal is that a subsequent user of a MAAS node has no knowledge about previous data loaded on that node.

[Gavin Panella (allenap)]

I think this falls under the nascent node lifecycle work, e.g. the decommission and recommission steps in http://goo.gl/ov8oqs. Like we have already to commission a node, we would have configurable steps when a node is taken out of service, or when it's being released to the pool.

[Joey Stanford (joey)]

As per bug #1336484 which I've duped into here, it needs to be "All physical media will need to have its data securely erased with a DoD 3-Pass Short Wipe (DoD 5220 22M) immediately after being taken out of service. "

[Julian Edwards (julian-edwards)]

How would people feel about making this a global configuration item?

[Graham Binns (gmb)]

On 2 July 2014 01:27, Julian Edwards <email address hidden> wrote:
> How would people feel about making this a global configuration item?

Who is "people"?

In Austin, we talked about introducing a decommissioning phase to the
node lifecycle; making this a global option seems to fit perfectly.
Making it a global option means we'll have to work out how to do it
for other OSes, but that shouldn't be too hard to achieve — I suppose
we could even do an ephemeral boot to wipe everything, but I'm getting
into implementation details now.

[Julian Edwards (julian-edwards)]

On 02/07/14 16:59, Graham Binns wrote:
> On 2 July 2014 01:27, Julian Edwards <email address hidden> wrote:
>> How would people feel about making this a global configuration item?
>
> Who is "people"?

Subscribers :)

> In Austin, we talked about introducing a decommissioning phase to the
> node lifecycle; making this a global option seems to fit perfectly.
> Making it a global option means we'll have to work out how to do it
> for other OSes, but that shouldn't be too hard to achieve — I suppose
> we could even do an ephemeral boot to wipe everything, but I'm getting
> into implementation details now.

OSes are irrelevant - you can reboot The One And Only OS in the
ephemeral environment and run a secure wipe prog.

You might have even just said that but I'm making it explicit :)

[Graham Binns (gmb)]

On 2 July 2014 08:21, Julian Edwards <email address hidden> wrote:
> You might have even just said that but I'm making it explicit :)

I did, but I obfuscated it by being sleepy. Thanks for clarifying it
for everyone else :)

[Joey Stanford (joey)]

Hi! From my point of view, a global would be fine.

I can imagine cases where only one group of nodes might need this and it would be overkill for the others. This would have a speed impact when deprovisioning.

Depending on how you implement this, you might be able to provide some additional tunables such as "how many passes"? (e.g. shred -vzf -n X /dev/sda where X is the number of passes (default of 3) for a non-journaled filesystem.)

Several SSDs support "Secure Erase" so you could do this as the disk/controller level vs using an OS command but this may end up being too custom.

If it's of any benefit, I'd be happy to brainstorm and/or review the implementation details with you when you work on this item.

[Blake Rouse (blake-rouse)]

This is now supported in 1.7. It is not enabled by default, but can be enabled on the settings page. All disks will be wiped when a node is released.

[Jason Hobbs (jason-hobbs)]

Just a minor note here - the feature in MAAS is called Disk Erasing - it doesn't make any claims to meet any security standards for disk erasure though, and isn't advertised as "secure disk wipe".

[Christian Reis (kiko)]

Fixing the status as per Blake's comment.