Secure File Deletion on VMFS

[John_Bergin]

I got pinged with a question regarding destruction of our VM's when we are done with them.

Right now we just "delete from disk".

Can other methods be used to make the removal of vmdk's more secure (and in a perfect world audit ready).

I searched the forums but I either didn't have the right query or no one has asked this question. If they have I apologize and link to that would suffice but it is an interesting question that I hadn't given much thought to before today.

[oreeh]

there are several ways to achieve this

IMHO the easiest way is the following

\- create 1 LUN / VM (I know this sounds weird but simplifies the following steps)

\- after deleting the VM / VMDK recreate a new VMDK on the same LUN using the maximum available space and create it using the eagerzeroedthick option

\- voila all space cleared and overwritten with zeroes

you can skip step one but then you have to create real big empty VMDKs and discard them

[John_Bergin]

That would work but,

I already have 2 - 750gb LUNs on a san in use. Now I need to go back and wipe the free space. Moving forward that would be a great idea but given how short the average VM lives in our VI it would impose a significant overhead to keep those prepped and ready to go.

[oreeh]

another possible way

create an VM running a minimal Linux

attach the VMDK you want to destroy to this VM

boot and issue a "dd if=/dev/null of=/dev/sdb" or whatever your disk device is

takes some time and your vmdk is purged

[John_Bergin]

That would also work and I guess we could log deletion of each vmdk as being scrubbed from the inside and then removed from disk.

My users are very used to simply "right click delete from disk" after a lot of training explaining remove from inventory just doesn't cut it.

I was planning on setting up a weekly process to purge the luns. It would be more difficult to automate the process you describe.

[oreeh]

I assume that you can script this using the SDKs

Also make sure (if this is a requirement) to remove any possible leak in the swap files.

Either put them on a separate LUN which regularly gets purged or configure the VMs with a 100% memory reservation (which in fact disables swap but has a side effect in disabling page sharing too)

If the possible leaked data is only a problem when creating new VMs simply create the new VMs using the eagerzeroedthick option

also these threads might help

http://www.vmware.com/community/thread.jspa?threadID=73150&tstart=0

http://www.vmware.com/community/thread.jspa?threadID=70884&tstart=0

http://www.vmware.com/community/thread.jspa?threadID=66085&tstart=0

[John_Bergin]

Great links. Definitely interesting topics. The first looks like they ended up taking your first idea of one vm, one lun, a step farther and making each vm route to an RDM volume.

In one of the posts they mention just running a linux disk wiping program on the host to wipe the VMFS volumes but that is what I am concerned about.

VMFS != ext3 and that makes me nervous

[oreeh]

making each vm route to an RDM volume

I really don't know where the benefit is in using RDMs in this scenario

VMFS != ext3 and that makes me nervous

make me nervous too

I never used the SDKs/APIs but I'll have to in an upcoming project.

Maybe I get into it and try to script the wiping stuff using the SDKs/APIs.

[John_Bergin]

I am trying to dig into the API to pull out the information I need in order to make sure things only get wiped if something has been deleted.

I expected more examples in the documentation for that but trial and error on a dev VI help.

[oreeh]

I knew there was a reason to avoid the API

[John_Bergin]

Have you gotten your board warrior shirt over in Germany? Still waiting on them here in the US and of course anything to avoid digging into an API is a plus.

[oreeh]

Still hoping that someday it will arrive - after I got an email where they should send them.

A few years ago I ordered shirts in the US.

Two years later - I already forgot I ordered them - they arrived - after a rather short loop way to South Africa!

Regarding the API: I will first try the Perl API - the other languages are to modern for a guy my age

Message was edited by:

oreeh

[oreeh · Accepted solution]

BTW: their was an update a few days ago from Daryll regarding shirts

http://www.vmware.com/community/thread.jspa?threadID=76495

[John_Bergin]

Saw the update on the shirts. In the earlier posts referenced I found a lot of great information but no one has signed off on using Linux wiping utilities to clean up free space in a LUN after VMDK deletion.

I am currently planning on migrating all my data to a new LUN structure and trying to keep those under 150gb in order to minimize the nasty disk locks that would happen during a write 0 to the disk vmdk creation. Especially if it is expanding to include say 300 gb of a 750 LUN.

[John_Bergin]

Going to close this one out as the information is definitely helpful but there is no clear way to make this happen.