I have three 11.11 servers that I will be decommissioning shortly. I would like to clean the disks before the servers are removed from the data center.
I have seen that there is a disk scrub for 11.31. Is there one for 11.11?
If not, what is the best, most secure way to clean the disks?
The disk scrub of which you speak isn't available in 11.11. That said, you can do one or more passes of this:
# dd if=/dev/zero of=/dev/rdsk/cXtYdZ bs=1024k
# dd if=/dev/urandom of=/dev/rdsk/cXtYdz bs=1024k
Note the large blocksize and the use of the raw device to bypass the buffer cache.
Generally one pass is sufficient for most purposes. Multiple (>10-15) passes are required to retard the spooks who _really_ want to discover your data.
Of course, as shredder and an acid bath work wonders.
Can I login to the server and do this from the command line while the server is up at run level 3? Or do I need to boot it off cd and run this command?
>>Can I login to the server and do this from the command line while the server is up at run level 3? Or do I need to boot it off cd and run this command?
You can do this for all disks that are NOT boot disks while the server is at run level 3.
For your boot disks, if you have a similar server, you can take them out of their primary server, insert them into another server and run the 'dd' from there.
In my environment, the only internal disks we have are boot disks. The rest of our disks are on the SAN. The internal disks are the ones that I am look to wipe clean.
There are three servers in all that I am decommissioning.
I could take the internal disks from two of the disks and put them into the third server but that still leaves me with one server's disks that I will not be able to wipe clean with the dd command.
I'd be less concerned about scrubbing a boot disk than one that had held sensitive data, assuming that its only the operating system contents on the disk. Patrick's suggestion is a good one for that, though.
If you are decommissioning a boot disk, you can start a 'dd' against it that grinds to an end. While the 'dd' runs, recursively remove mountpoints and the kernel ('/stand/vmunix') itself. You won't be booting the disk again.
If you are really concerned about the data, just destroy the disks. If you have a large magnet, run that over the disks. Other options are: a hammer, a drill (drill THROUGH the entire drive, including disk platters), an acid bath.
