1.5. Cleaning an sos report

Prerequisites

• You have generated an sos report or an sos collect tarball.
• (Optional) You have a list of specific keywords beyond the user names, host names, and other data you want to obfuscate.

Procedure

• Run the sos clean command on either an sos report or sos collect tarball and follow the on-screen instructions.

  1. You can add the --keywords option to additionally clean a given list of keywords.

  2. You can add the --usernames option to obfuscate further sensitive user names.

     The automatic user name cleaning will automatically run for users reported through the lastlog file for users with an UID of 1000 and above. This option is used for LDAP users that may not appear as an actual login, but may occur in certain log files.

     [user@server1 ~]$ sudo sos clean /var/tmp/sos-collector-2022-05-15-pafsr.tar.xz
     [sudo] password for user:
     
     sos clean (version 4.2)
     
     This command will attempt to obfuscate information that is generally considered to be potentially sensitive. Such information includes IP addresses, MAC addresses, domain names, and any user-provided keywords.
     
     Note that this utility provides a best-effort approach to data obfuscation, but it does not guarantee that such obfuscation provides complete coverage of all such data in the archive, or that any obfuscation is provided to data that does not fit the description above.
     
     Users should review any resulting data and/or archives generated or processed by this utility for remaining sensitive content before being passed to a third party.
     
     
     Press ENTER to continue, or CTRL-C to quit.
     
     Found 4 total reports to obfuscate, processing up to 4 concurrently
     
     sosreport-primary-rhel10-2022-05-15-nchbdmd :      Extracting...
     sosreport-sos-node1-2022-05-15-wmlomgu :      Extracting...
     sosreport-sos-node2-2022-05-15-obsudzc :      Extracting...
     sos-collector-2022-05-15-pafsr :                   Beginning obfuscation...
     sosreport-sos-node1-2022-05-15-wmlomgu :      Beginning obfuscation...
     sos-collector-2022-05-15-pafsr :                   Obfuscation completed
     sosreport-primary-rhel10-2022-05-15-nchbdmd :      Beginning obfuscation...
     sosreport-sos-node2-2022-05-15-obsudzc :      Beginning obfuscation...
     sosreport-primary-rhel10-2022-05-15-nchbdmd :      Re-compressing...
     sosreport-sos-node2-2022-05-15-obsudzc :      Re-compressing...
     sosreport-sos-node1-2022-05-15-wmlomgu :      Re-compressing...
     sosreport-primary-rhel10-2022-05-15-nchbdmd :      Obfuscation completed
     sosreport-sos-node2-2022-05-15-obsudzc :      Obfuscation completed
     sosreport-sos-node1-2022-05-15-wmlomgu :      Obfuscation completed
     
     Successfully obfuscated 4 report(s)
     
     A mapping of obfuscated elements is available at
         /var/tmp/sos-collector-2022-05-15-pafsr-private_map
     
     The obfuscated archive is available at
         /var/tmp/sos-collector-2022-05-15-pafsr-obfuscated.tar.xz
     
         Size    157.10KiB
         Owner    root
     
     Please send the obfuscated archive to your support representative and keep the mapping file private

Verification

• Verify that the sos clean command created an obfuscated archive and an obfuscation mapping in the /var/tmp/ directory matching the description from the command output.

  [user@server1 ~]$ sudo ls -l /var/tmp/sos-collector-2022-05-15-pafsr-private_map /var/tmp/sos-collector-2022-05-15-pafsr-obfuscated.tar.xz
  [sudo] password for user:
  
  -rw-------. 1 root root 160868 May 15 16:10 /var/tmp/sos-collector-2022-05-15-pafsr-obfuscated.tar.xz
  -rw-------. 1 root root  96622 May 15 16:10 /var/tmp/sos-collector-2022-05-15-pafsr-private_map

• Check the *-private_map file for the obfuscation mapping:

  [user@server1 ~]$ sudo cat /var/tmp/sos-collector-2022-05-15-pafsr-private_map
  [sudo] password for user:
  
  {
      "hostname_map": {
          "pmoravec-rhel10": "host0"
      },
      "ip_map": {
          "10.44.128.0/22": "100.0.0.0/22",
  ..
      "username_map": {
          "foobaruser": "obfuscateduser0",
          "jsmith": "obfuscateduser1",
          "johndoe": "obfuscateduser2"
      }
  }