6

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the document.

Assume the following procedure:

  • The usb drive is inserted to the computer and mounted.
  • The document is opened with okular or evince and printed directly from the program.
  • The usb drive is unmounted and removed from the computer.

Question: What do I need to do to wipe any traces / copies of the document I printed?

First idea: I guess /tmp would be a good place to look out for - though I do not know if there will be any copies stored there or at other places. Do I have to do additional steps to remove all traces / copies?

Further information: It is a local printer. Both me and other users have root privileges.

Improve this question
5
  • 3
    Is it a local printer or a remote (network) printer? Does any of the users have root privileges? Do you have root privileges? Note that that depending on the configuration there might be a permanent copy kept by the local/remote printer. Also, printer keeps at least a temporary copy below /var/spool/cups/.
    – Steffen Ullrich
    Commented Oct 26, 2019 at 20:50
  • Thank you for your help! I added some clarifications to the question. Copies on the printer might indeed be an issue, but as far as I understand printing enough documents after the confidential one overwrites the memory eventually (that should suffice for this case). Thanks for the hint with /var/spool/cups!
    – user103128
    Commented Oct 27, 2019 at 6:37
  • Are the other users are potentially malicious? Since others have root access it would be possible for them to slightly modify the system in order to preserve a copy of each printed document. Also, you don't need to open the document in some GUI pdf reader but could just directly lpr the pdf to the printer. This is then one less thing to worry about.
    – Steffen Ullrich
    Commented Oct 27, 2019 at 7:16
  • Printing via lpr is a good point. I assume that other users might carefully inspect all files on the drive after the printing and might even restore deleted files (so a thorough wipe is required), but I do not assume that they have made any preparations to preserve copies. Also, there is no access from other users to the computer between inserting and removing the usb drive / cleaning up.
    – user103128
    Commented Oct 27, 2019 at 9:06
  • 1
    If other uses have root privileges then NO. You can not defend against root.
    – Martin Schröder
    Commented Oct 27, 2019 at 11:06

1 Answer 1

Reset to default
3

You can just use lpr to send the PDF file from USB stick directly to the printer spooler. But then it gets ugly: The printer spooler (cups) itself first will have a copy of this file somewhere below /var/spool/cups. Depending on the setup and printer driver used there will be further processing of the PDF file to translate it into something the printer then can understand (i.e. PCL or others). This processing will likely also create additional files, maybe below /var/spool/cups too but maybe also in /tmp or /var/tmp or other places.

Most of these files will be deleted once the processing or printing is done which means that there is no way to access these specific files afterwards for secure deletion. All you could try to do is to make sure nothing on the system at all can be undeleted by using tools like sfill. It might be though that the system is specifically configured to keep copies of some of these files for audit or debug purposes. In short: it is a mess.

And this already assumes that the other users on the system who all have root access will not have tampered with the system in order to find out what others print. In my opinion this kind of assumption is questionable since users who are willing to put lots of effort (and luck) into restoring deleted files are likely willing to change the configuration to keep files "for debugging printer issues" too.

In other words: don't print sensitive data on a system where you fear that other users on the system might be interested in what you print and have the capabilities (root access) to find out.

Improve this answer
3
  • Thank you once again. I probably have to accept that the approach is not feasible from a security point of view.
    – user103128
    Commented Oct 27, 2019 at 18:33
  • Maybe it would help to mount a location such as /var/spool/cups as a ramfs so the file never hits disk (in theory)? Even if the memory isn't zeroed after erase, it may be more difficult to recover it.
    – multithr3at3d
    Commented Oct 27, 2019 at 20:40
  • Actually, I think the most practical solution would be to bring the file on a notebook rather than on a usb flash drive and connect the notebook directly to the printer.
    – user103128
    Commented Oct 28, 2019 at 6:53

You must log in to answer this question.