1

A vendor requested a complete backup of a server for troubleshooting a bare metal restore issue, but they said we are free to exclude any sensitive data.

I’m thinking I’ll exclude:

  • /etc/shadow
  • exim.conf (it contains a password / API key)
  • any SSL private keys and SSH private keys of concern
  • /etc/group
  • /etc/gshadow
  • /root/*
  • /etc/my.cnf
  • /etc/ssl/*
  • /etc/pki/*
  • /root/.ssh/*
  • /var/lib/mysql/mysql

Does this seem good or is there anything else important I'm missing? I know the answer depends on what's on the server / what it's being used for, but I imagine there might be some good general "be sure to think of ____" responses.

5
  • What kind of vendor is this? Why do they need a complete backup of the server? What problems are they troubleshooting? – Lie Ryan Sep 8 '15 at 1:48
  • @LieRyan It's a backup software vendor that provides software that supports block level backups with bare metal restore capability. Because bare metal restore may be to different hardware, when restoring, the software modifies grub.conf to ensure the system will boot on the new environment. In a test bare metal restore we were doing, their software messed it up and they said they need to see exactly what it's doing and asked if I could provide the backups but feel free to exclude any sensitive info. – sa289 Sep 8 '15 at 2:47
  • If these are block level backup, then the backup system probably isn't aware of the filesystem, so the backup image may contain blocks that are considered free space by the filesystem which may contain sensitive data that has been deleted. Make sure you remove all free spaces from the backup image. – Lie Ryan Sep 8 '15 at 4:02
  • @LieRyan Good point but this one happens to be filesystem aware. You can choose to do a raw sector by sector backup which grabs free space too, or you can choose to do a filesystem-aware block-level backup in which case it only backs up blocks containing data. Of course this is only for supported filesystems, but the one we're using is supported. – sa289 Sep 8 '15 at 4:19
  • 1
    You may also want to exclude the system logs (or heavily scrutinize the logs to give out). Less carefully written applications may log sensitive information. Application logs, mail server logs, or MySQL logs may not be necessary to debug the issue and could be removed. If running a mail server, make sure the mail spool is empty. Likewise, if you run a task/message queue service, especially if they're configured for reliable delivery. – Lie Ryan Sep 8 '15 at 4:22
1

there are sometimes automated backup-files for various reasons, so i'd add

/etc/shadow*
/etc/passwd*
/etc/gshadow*
/etc/group*
/etc/*~
/home/**/.ssh/*

and, because one never knows ...

/tmp/*
/var/tmp/*
/var/spool

Not the answer you're looking for? Browse other questions tagged or ask your own question.