1.6. Generating an sos report and securing it with GPG passphrase encryption

Procedure

1. Run the sos report command and specify a passphrase with the --encrypt-pass option. You can add the --upload option to transfer the sos report to Red Hat immediately after generating it.

   [user@server1 ~]$ sudo sos report --encrypt-pass my-passphrase
   [sudo] password for user:
   
   sosreport (version 4.2)
   
   This command will collect diagnostic and configuration information from
   this Red Hat Enterprise Linux system and installed applications.
   
   An archive containing the collected information will be generated in
   /var/tmp/sos.6lck0myd and may be provided to a Red Hat support
   representative.
   
   ...
   
   Press ENTER to continue, or CTRL-C to quit.

2. Optional: If you have already opened a Technical Support case with Red Hat, enter the case number to embed it in the sos report file name, and it will be uploaded to that case if you specified the --upload option. If you do not have a case number, leave this field blank. Entering a case number is optional and does not affect the operation of the sos utility.

   Please enter the case id that you are generating this report for []: <8-digit_case_number>

3. Take note of the sos report file name displayed at the end of the console output.

   Finished running plugins
   Creating compressed archive...
   
   Your sosreport has been generated and saved in:
   /var/tmp/secured-sosreport-server1-12345678-2022-01-24-ueqijfm.tar.xz.gpg
   
   Size    17.53MiB
   Owner   root
   sha256     bf303917b689b13f0c059116d9ca55e341d5fadcd3f1473bef7299c4ad2a7f4f
   
   Please send this file to your support representative.

Verification

1. Verify that the sos utility created an archive meeting the following requirements:

   • File name starts with secured.
   • File name ends with a .gpg extension.

   • Located in the /var/tmp/ directory.

     [user@server1 ~]$ sudo ls -l /var/tmp/sosreport*
     [sudo] password for user:
     -rw-------. 1 root root 18381537 Jan 24 17:55 /var/tmp/secured-sosreport-server1-12345678-2022-01-24-ueqijfm.tar.xz.gpg

2. Verify that you can decrypt the archive with the same passphrase you used to encrypt it.

   1. Use the gpg command to decrypt the archive.

      [user@server1 ~]$ sudo gpg --output decrypted-sosreport.tar.gz --decrypt /var/tmp/secured-sosreport-server1-12345678-2022-01-24-ueqijfm.tar.xz.gpg

   2. When prompted, enter the passphrase you used to encrypt the archive.

      ┌──────────────────────────────────────────────────────┐
      │ Enter passphrase                                     │
      │                                                      │
      │                                                      │
      │ Passphrase: <passphrase>                             │
      │                                                      │
      │       <OK>                              <Cancel>     │
      └──────────────────────────────────────────────────────┘

   3. Verify that the gpg utility produced an unencrypted archive with a .tar.gz file extension.

      [user@server1 ~]$ sudo ls -l decrypted-sosreport.tar.gz
      [sudo] password for user:
      -rw-r--r--. 1 root root 18381537 Jan 24 17:59 decrypted-sosreport.tar.gz