1.7. Generating an sos report and securing it with GPG encryption based on a keypair

Procedure

1. Run the sos report command and specify the user name that owns the GPG keyring with the --encrypt-key option. You can add the --upload option to transfer the sos report to Red Hat immediately after generating it.

   참고

   The user running the sos report command must be the same user that owns the GPG keyring used to encrypt and decrypt the sos report. If the user uses sudo to run the sos report command, the keyring must also be set up using sudo, or the user must have direct shell access to that account.

   [user@server1 ~]$ sudo sos report --encrypt-key root
   [sudo] password for user:
   
   sosreport (version 4.2)
   
   This command will collect diagnostic and configuration information from
   this Red Hat Enterprise Linux system and installed applications.
   
   An archive containing the collected information will be generated in
   /var/tmp/sos.6ucjclgf and may be provided to a Red Hat support
   representative.
   
   ...
   
   Press ENTER to continue, or CTRL-C to quit.

2. Optional: If you have already opened a Technical Support case with Red Hat, enter the case number to embed it in the sos report file name, and it will be uploaded to that case if you specified the --upload option. If you do not have a case number, leave this field blank. Entering a case number is optional and does not affect the operation of the sos utility.

   Please enter the case id that you are generating this report for []: <8-digit_case_number>

3. Take note of the sos report file name displayed at the end of the console output.

   ...
   Finished running plugins
   Creating compressed archive...
   
   Your sosreport has been generated and saved in:
   /var/tmp/secured-sosreport-server1-23456789-2022-02-27-zhdqhdi.tar.xz.gpg
   
   Size    15.44MiB
   Owner   root
   sha256  bf303917b689b13f0c059116d9ca55e341d5fadcd3f1473bef7299c4ad2a7f4f
   
   Please send this file to your support representative.

Verification

1. Verify that the sos utility created an archive meeting the following requirements:

   • File name starts with secured.
   • File name ends with a .gpg extension.

   • Located in the /var/tmp/ directory.

     [user@server1 ~]$ sudo ls -l /var/tmp/sosreport*
     [sudo] password for user:
     -rw-------. 1 root root 16190013 Jan 24 17:55 /var/tmp/secured-sosreport-server1-23456789-2022-01-27-zhdqhdi.tar.xz.gpg

2. Verify you can decrypt the archive with the same key you used to encrypt it.

   1. Use the gpg command to decrypt the archive.

      [user@server1 ~]$ sudo gpg --output decrypted-sosreport.tar.gz --decrypt /var/tmp/secured-sosreport-server1-23456789-2022-01-27-zhdqhdi.tar.xz.gpg

   2. When prompted, enter the passphrase you used when creating the GPG key.

      ┌────────────────────────────────────────────────────────────────┐
      │ Please enter the passphrase to unlock the OpenPGP secret key:  │
      │ "GPG User (first key) <root@example.com>"                      │
      │ 2048-bit RSA key, ID BF28FFA302EF4557,                         │
      │ created 2020-01-13.                                            │
      │                                                                │
      │                                                                │
      │ Passphrase: <passphrase>                                       │
      │                                                                │
      │         <OK>                                    <Cancel>       │
      └────────────────────────────────────────────────────────────────┘

   3. Verify that the gpg utility produced an unencrypted archive with a .tar.gz file extension.

      [user@server1 ~]$ sudo ll decrypted-sosreport.tar.gz
      [sudo] password for user:
      -rw-r--r--. 1 root root 16190013 Jan 27 17:47 decrypted-sosreport.tar.gz