Description

This Article describes how to perform secure erase on a PTX1000 device. 

Secure erase refers to the process of permanently removing data from a storage device, ensuring that it cannot be recovered. This is different from standard file deletion, which typically only removes the file's reference in the system's file table, leaving the actual data intact and recoverable with specialized software. Secure erase techniques are used to protect sensitive information and are often employed before decommissioning or repurposing computer networking devices.

Symptoms

There are no symptoms as this is an informational KB required to securely erase the  SSD of the PTX1000. Customers may use this method to erase the sensitive data from the device's SSD while returning to Juniper.

Solution

This procedure is tested in the lab and works with Junos OS 17.4 and later.

Requirements:

  • Be able to access the router. It is not necessary to log in via console
  • Be able to log in as a "root" user at the Junos level

Instructions:

  1. Login to the PTX1000

  2. If you are at the "cli>" prompt, login to the FreeBSD shell "as root" user with the command:                            start shell user root<enter>
  3. Once at the FreeBSD shell prompt, you will see the prompt change to <hostname> # If you do not see the "#" character at the prompt, you are not logged in correctly. Please check your typing and password Issue the following command to go to the Linux shell:                                                                                                    vhclient -s
  4. At the Linux shell, you log in as "root" user. We will be checking the status of the SSDs. Type the following command to show the SSD's capabilities                                                                                                          hdparm -I /dev/sda
  5.  Look for the section that says "Security:". It usually is line number 13th from the bottom. It should look like this:
Security:
Master password revision code = 65534
supported
not enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY
ERASE UNIT.
Device Sleep:
DEVSLP Exit Timeout (DETO): 70 ms (drive)
Minimum DEVSLP Assertion Time (MDAT): 31 ms (drive)
Checksum: correct
          6. The important information are:
  • not locked
  • not frozen
  • The estimated time to complete SECURE ERASE.
         7. In this example, 2 minutes. Time may vary on your drive If you see "locked", or "frozen", you may need to       reboot the router to unlock and unfreeze the SSD.
         8. Set a temporary password. This is required to issue the secure erase command.The password can be anything.               But make sure you remember it. I will be using. "Juniper" in this example:
hdparm --user-master u --security-set-pass Juniper /dev/sda
You will see the response:
security_password="Juniper"
/dev/sda:
Issuing SECURITY_SET_PASS command, password="Juniper", user=user,
mode=high
          9. Check the status of the SSD using the "hdparm" command:
hdparm -I /dev/sda
Make sure that it says "enable" and "Security level high"
...
Security:
Master password revision code = 65534
supported
enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
Security level high
2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
Device Sleep:
DEVSLP Exit Timeout (DETO): 70 ms (drive)
Minimum DEVSLP Assertion Time (MDAT): 31 ms (drive)
Checksum: correct
         10. Now we are ready to erase the disk. Make sure that you want to do this.This is not reversible. The only                     way to recover from this is to reinstall Junos software using USB
         11.Issue the following command:
hdparm --user-master u --security-erase-enhanced Juniper /dev/sda
The response from hdparm is as follow:
security_password="Juniper"
/dev/sdb:
Issuing SECURITY_ERASE command, password="Juniper", user=user

        12. Repeat step 4 - 9 for /dev/sdb

        13. You are done. Wait for the time that shows in step 7. Then you can power off the system.

NOTE: After the secure erase, you will start getting errors when you try to shut down using the "reboot", or "shutdown".  This is because the content of the drives is gone.

root@u11-1-node:~# reboot
-sh: /sbin/reboot: cannot execute binary file
root@u11-1-node:~# shutdown now
-sh: /sbin/shutdown: cannot execute binary file
root@u11-1-node:~# md8.uzip: UZIP(zlib) inflate() failed
g_vfs_done():md8.uzip[READ(offset=12580864, length=2048)]error = 86
vm_fault: pager read error, pid 5842 (mib2d)
md9.uzip: UZIP(zlib) inflate() failed
g_vfs_done():md9.uzip[READ(offset=228460544, length=2048)]error = 86
vm_fault: pager read error, pid 5842 (mib2d)
You will also see all kinds of weird things on the console. "ls" shows files but you won't
be able to see their contents. This is normal since Linux cache the file system directory
in memory.

 

Modification History

2024-07-02 : Article Created