Data obfuscation

Red Hat Lightspeed provides optional controls to obfuscate IP addresses, MAC addresses, and hostnames in the data archive and the user interface. These controls mask sensitive information before it reaches Red Hat.

Data obfuscation considerations and limitations
Copy link

Obfuscation capabilities depend on your connection type and client tool configuration. Consider feature level requirements and data privacy when configuring obfuscation.

Several client tools and products from Red Hat work together to provide a full range of functionalities. Depending on your setup, different tools can collect information from your systems at the same time. Some of the tools have built-in features for configuring obfuscation or redaction. To achieve the required state of data privacy, you must take many aspects into consideration, such as the feature-level requirements and how the system consumes the content.

Important

Directly connected systems. You cannot achieve true obfuscation or redaction of system information. The subscription-manager must remain enabled on the system and continues to report data.

This applies regardless of how insights-client or rhc are configured.

You cannot prevent the collection of certain key system information such as the hostname, or IP and MAC addresses. For directly connected systems, even configuring data obfuscation in the insights-client does not achieve the expected results.

Systems connected to a Red Hat Satellite or Capsule. You cannot fully prevent collection of key system information such as hostname, IP, and MAC addresses. However, you can adjust the feature level and configure Satellite so that data is never sent to Red Hat.

Data obfuscation on the system
Copy link

Full data obfuscation requires systems that are registered to Red Hat Satellite with client tools and server settings configured to enable obfuscation.

You can enable the insights-client obfuscation feature to replace the hostname, IP address, or MAC address with preset values in the Red Hat Lightspeed archive. A Python data cleaning process generates the replacement values. The processed archive file is then sent to Red Hat Lightspeed. Obfuscation is disabled by default.

Note
  • The Python data cleaning process automatically generates the masked values. You cannot choose the values for obfuscation.
  • The Red Hat Lightspeed compliance service uses OpenSCAP tools to generate compliance reports based on information from the host system. The compliance service uses OpenSCAP, which prevents complete obfuscation or redaction of hostname and IP address data. Host information is also sent to Red Hat Lightspeed when a compliance data collection job runs on the host system.

Obfuscate IPv4 IP addresses
Copy link

If your hosts use IPv4 IP addresses, enable obfuscation in the insights-client configuration file to mask sensitive data in the archive file before it is sent to Red Hat Lightspeed.

Before you begin
Copy link

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:
    • In the Satellite web UI, navigate to Administer > Settings > Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

About this task
Copy link

When you enable obfuscation, the original IP address of the host is replaced with a generated value in the archive file. This obfuscated value is used in the Red Hat Hybrid Cloud Console UI, logs, and any archive data files that Red Hat collects. However, you still see the original IP address in the command-line output of some insights-client commands.

Important
The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host IP address to obfuscate.

Procedure
Copy link

  1. Open the /etc/insights-client/insights-client.conf file with an editor.
  2. Locate the following section: 
    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma-separated list)
# obfuscation_list=
  3. Remove the preceding hash (#) character, before obfuscation_list=, and add the following line: 
    obfuscation_list=ipv4
  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.
    Important
    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.
  5. Save and close the /etc/insights-client/insights-client.conf file.

Results
Copy link

When obfuscation is enabled, the original IPv4 address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important
After you enable obfuscation, you continue to see the original IPv4 address in the command-line output of some insights-client commands.
  • Original host system IP address: 
    192.168.0.24
  • Obfuscated host IP address: 
    10.230.230.1
  • Obfuscated IPv4 IP address in the Red Hat Hybrid Cloud Console UI:

    An example of an obfuscated IPv4 IP address in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated IP address gets generated. Therefore, in the example scenario provided, when you search or filter by IP address in the Red Hat Lightspeed UI on the Hybrid Cloud Console you might see several instances of 10.230.230.1. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses, can generate the same obfuscated IP address in the archive file.

Obfuscate IPv6 IP addresses
Copy link

If your hosts use IPv6 IP addresses, enable obfuscation in the insights-client configuration file to mask sensitive data in the archive file before it is sent to Red Hat Lightspeed.

Before you begin
Copy link

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:
    • In the Satellite web UI, navigate to Administer > Settings > Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

About this task
Copy link

When you enable obfuscation, the original IP address of the host is replaced with a generated value in the archive file. This obfuscated value is used in the Red Hat Hybrid Cloud Console UI, logs, and any archive data files that Red Hat collects. However, you still see the original IP address in the command-line output of some insights-client commands.

Important
The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host IP address to obfuscate.

Procedure
Copy link

  1. Open the /etc/insights-client/insights-client.conf file with an editor.
  2. Locate the following section: 
    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma separated list)
# obfuscation_list=
  3. Remove the preceding hash (#) character, before obfuscation_list=, and add the following line: 
    obfuscation_list=ipv6
  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.
    Important
    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.
  5. Save and close the /etc/insights-client/insights-client.conf file.

Results
Copy link

When obfuscation is enabled, the original IPv6 address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important
After you enable obfuscation, you continue to see the original IP address in the command-line output of some insights-client commands.
  • Original host system IPv6 addresses: 
    ff00:f800:f801:f802::f806
ff00:f800:f801:f802:f00:f803:f804:f805
ff01::f00:f803:f804:f805
  • Obfuscated host IPv6 addresses: 
    fc47:d0f1:5ae7:e4e9::0477,
fc47:d0f1:5ae7:e4e9:fee:3939:5b4a:2c55,
70f1::fee:3939:5b4a:2c55,
  • Obfuscated IPv6 IP addresses in the Red Hat Hybrid Cloud Console UI:

    An example of an obfuscated IP addresses in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated IP address gets generated. Therefore, in the scenario provided, when you search or filter by IP address in the Red Hat Lightspeed UI on the Hybrid Cloud Console, you might see several instances of 70f1::fee:3939:5b4a:2c55. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses can generate the same obfuscated IP address in the archive file.

Obfuscate MAC addresses
Copy link

You can mask the Media Access Control (MAC) addresses of your hosts in the archive file before it is sent to Red Hat Lightspeed by enabling obfuscation.

Before you begin
Copy link

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:
    • In the Satellite web UI, navigate to Administer > Settings > Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

About this task
Copy link

Important
The obfuscation process uses a Python data cleaning process to generate a unique value for each host. You cannot configure the value provided for obfuscation. You also cannot obfuscate or select the portion of the host MAC address to obfuscate.

Procedure
Copy link

  1. Open the /etc/insights-client/insights-client.conf file with an editor.
  2. Locate the following section: 
    # Specify which will be obfuscated in the data collection,
# empty by default, and supported options are: ipv4, ipv6, hostname, mac
# (comma separated list)
# obfuscation_list=
  3. Remove the preceding hash (#) character, before obfuscation_list= and add the following line: 
    obfuscation_list=mac
  4. If your configuration file contains the older obfuscate=True or obfuscate=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.
    Important
    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.
  5. Save and close the /etc/insights-client/insights-client.conf file.

Results
Copy link

When obfuscation is enabled, the original MAC address is masked in the console UI, logs, and archive data files that Red Hat collects.

Important
After you enable obfuscation, you continue to see the original MAC address in the command-line output of some insights-client commands.
  • Original host system MAC address: 
    08:00:27:7c:fc:0f
  • Obfuscated host MAC address: 
    1e:fb:bc:2e:4a:6d
  • Obfuscated MAC address in the Red Hat Hybrid Cloud Console:

    An example of an obfuscated MAC address in the Red Hat Hybrid Cloud Console UI

Note

When you enable obfuscation on several systems, the same obfuscated MAC address gets generated. Therefore, in the example scenario provided, when you search or filter by MAC address in the Red Hat Lightspeed UI on the Hybrid Cloud Console, you might see several instances of 1e:fb:bc:2e:4a:6d. This is because the Python data cleaning process that the Red Hat Lightspeed obfuscation feature uses can generate the same obfuscated MAC address in the archive file.

Obfuscate hostnames
Copy link

Configure insights-client to obfuscate hostnames by replacing the value in /etc/hostname with an automatically generated UUID before sending data to Red Hat.

Before you begin
Copy link

  • If you are using Red Hat Satellite to manage clients and register them on the Red Hat Hybrid Cloud Console, you must also configure the Red Hat Cloud settings before you can enable obfuscation in Red Hat Lightspeed:
    • In the Satellite web UI, navigate to Administer > Settings > Red Hat Cloud and enable the required obfuscation settings that apply to your environment.

About this task
Copy link

During data obfuscation, a Python process generates a 12-character UUID to mask the hostname in the data archive file and Hybrid Cloud Console. The masked data is then sent to Red Hat.

Tip
An obfuscated hostname can be difficult to recognize. Setting a display name can help you to more easily identify your obfuscated hosts. The display name does not get obfuscated and displays in the Red Hat Lightspeed console UI. Only the value of /etc/hostname gets obfuscated.

Procedure
Copy link

  1. Open the /etc/insights-client/insights-client.conf file with an editor.
  2. Locate the following section: 
    obfuscation_list=
  3. Add the following line to the obfuscation_list section to enable hostname obfuscation: 
    obfuscation_list=hostname
    Note
    To add multiple obfuscation options, separate them with commas. For example, to obfuscate the hostname and an IPv6 IP address, add:
     
    obfuscation_list=hostname,ipv6
  4. If your configuration file contains the older obfuscate_hostname=True or obfuscate_hostname=False Red Hat Lightspeed obfuscation setting, remove that line of configuration.
    Important
    Remove deprecated obfuscate and obfuscate_hostname options from the configuration file. If your configuration file contains both obfuscation_list and deprecated options, the obfuscation_list takes precedence and insights-client displays a warning message in the output.
  5. Optional: Assign a display name to your system so that you can more easily find and manage your obfuscated hosts in the Red Hat Lightspeed console UI by adding the following line: 
    display_name=example-display-name
    Note
    You can also set a display name by using the following command:
     
    [root@rhlightspeed]# insights-client --display-name ITC-4
  6. Save and close the /etc/insights-client/insights-client.conf file.

Results
Copy link

  • When obfuscation is successfully enabled, the hostname gets masked in the Red Hat Lightspeed console UI, logs, and any archive data files that Red Hat collects.
  • If you configure hostname obfuscation on more than one system, you might see multiple systems with the same hostname in the Red Hat Lightspeed GUI as a result of obfuscation.
  • After you enable obfuscation, there might be instances where the original hostname displays in the command-line output of some insights-client commands.
  • The original hostname of the system in /etc/hostname: 
    RTP.data.center.01
  • Obfuscated /etc/hostname as displayed in Red Hat Lightspeed: 
    90f4a9365ce0.example.com
  • Obfuscated hostname and IP address in the Red Hat Hybrid Cloud Console:

    An example of an obfuscated hostname in the Red Hat Hybrid Cloud Console UI