I'm trying to make a service that keeps as little data on its users as possible. To that end, I want to make sure that someone using forensic tools won't gain any more information than I would by looking at my database or filesystem. In other words, you shouldn't be able to go through my hard drive with a hex editor and find a message that a user deleted yesterday.
Measures I've taken already:
I delete logfiles with identifying info within 30 minutes. I have swap turned off. I have
/var/log mounted on a RAM-disk. I've removed
rm, and put a hardlink to
srm in its place.
I have a hard drive that does not reallocate blocks, unless there is a bad sector.
Problems with my system currently:
- If a sensitive file is modified and made smaller, that will (AFAIK) deallocate a sector, which will then not be shredded, even if
srmis called on the file.
rmdoes nothing for programs that call unlink directly.
I have rows in MySQL that contain sensitive data. I delete those rows, but I'm concerned that MySQL keeps them around somehow.
Edit: It appears that SQLite has a config setting called
secure_delete. I'll use SQLite instead.
- Set the chattr attribute
s(secure deletion) I don't have this set now because the chattr manual says that ext2/3/4 ignores this flag. I found conflicting information about whether ext4 supports it. Which filesystems respect it?
- Wipe free space. Seems like kind of a sledgehammer approach, but I can't figure out a way to solve #1 otherwise. Also, the ways I've seen for doing this involve making a really big file, then deleting it. I'm concerned that it might make a program crash when this system is almost out of space.
I could make text backups of the MySQL database (which definitely don't contain the deleted rows) delete the originals, then restore them. Switch to a different SQL daemon?
- Reboot to clear the RAM disk. However, I don't want frequent downtime. Also, it wouldn't do anything to clear out data lingering on the hard drive.
What's the best way to fix these
three two problems? I'm currently using Arch Linux with ext3 and MySQL SQLite. I'm willing to change out any of those.
Thanks for your attention!