From 9ce47017d8d1025fb64d3f8d616b8e618f7a760a Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Mon, 1 Dec 2025 12:19:51 +0100 Subject: [PATCH] bin: add optional support for encrypting the support tarball This commit adds optional support for encrypting the tarball before it leaves the target system. Documentation and usage text updated. Signed-off-by: Joachim Wiberg --- doc/system.md | 41 +++++++++++++++++ src/bin/support | 117 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 128 insertions(+), 30 deletions(-) diff --git a/doc/system.md b/doc/system.md index de2b19ca..86648df2 100644 --- a/doc/system.md +++ b/doc/system.md @@ -357,6 +357,47 @@ The collection process may take up to a minute depending on system load and the amount of logging data. Progress messages are shown during the collection process. +### Encrypted Collection + +For secure transmission of support data, the archive can be encrypted +with GPG using a password: + +```bash +admin@host:~$ support collect -p mypassword > support-data.tar.gz.gpg +Starting support data collection from host... +This may take up to a minute. Please wait... +... +Collection complete. Creating archive... +Encrypting with GPG... +``` + +The `support collect` command even supports omitting `mypassword` and +will then prompt interactively for the password. This works over SSH too, +but the local ssh client may then echo the password. + +> [!TIP] +> To hide the encryption password for an SSH session, the script supports reading from stdin: +> `echo "$MYSECRET" | ssh user@device support collect -p > file.tar.gz.gpg` + +After transferring the resulting file to your workstation, decrypt it +with the password: + +```bash +$ gpg -d support-data.tar.gz.gpg > support-data.tar.gz +$ tar xzf support-data.tar.gz +``` + +or + +```bash +$ gpg -d support-data.tar.gz.gpg | tar xz +``` + +> [!IMPORTANT] +> Make sure to share `mypassword` out-of-band from the encrypted data +> with the recipient of the data. I.e., avoid sending both in the same +> plain-text email for example. + ### What is Collected The support archive includes: diff --git a/src/bin/support b/src/bin/support index d1de72ee..75fcaf79 100755 --- a/src/bin/support +++ b/src/bin/support @@ -1,34 +1,41 @@ #!/bin/sh # Support utilities for troubleshooting Infix systems # -# Usage: support [options] +# The following text is primarily intended for users of older Infix +# systems that do not yet have this script in the root fileystems. # -# Commands: -# collect [--log-sec N] Collect system information for support/troubleshooting -# clean [--dry-run] [--days N] Remove old support collection directories -# -# Options for collect: -# --log-sec N Tail /var/log/messages for N seconds (default: 30) -# -# Examples: -# support collect > support-data.tar.gz -# support collect --log-sec 5 > support-data.tar.gz -# ssh user@device support collect > support-data.tar.gz -# support clean --dry-run -# support clean --days 30 -# -# Installation (for older Infix versions without this script): # 1. Copy this script to the target device's home directory: -# scp support user@device:~/ +# scp support user@device: # # 2. SSH to the device and make it executable: # ssh user@device # chmod +x ~/support # # 3. Run the script from your home directory: -# ~/support collect > support-data.tar.gz -# # Or directly via SSH from your workstation: -# ssh user@device '~/support collect' > support-data.tar.gz +# +# ~/support collect > support-data.tar.gz +# +# Or directly via SSH from your workstation: +# +# ssh user@device '~/support collect' > support-data.tar.gz +# +# Optionally, the output can be encrypted with GPG using a password for +# secure transmission to support personnel, see below. +# +# Examples: +# support collect > support-data.tar.gz +# support collect -s 5 > support-data.tar.gz +# support collect -p > support-data.tar.gz.gpg +# support collect -p mypass > support-data.tar.gz.gpg +# +# ssh user@device support collect > support-data.tar.gz +# ssh user@device support collect -p mypass > support-data.tar.gz.gpg +# +# Note, interactive password prompt (-p without argument) may echo characters +# over SSH due to local terminal echo. Use -p PASSWORD for remote execution, +# or pipe the password: echo "password" | ssh user@device support collect -p +# meaning you can even: echo "$SECRET_VARIABLE" | ... which in some cases can +# come in handy. # # TODO: # Add more commands, e.g., verify (run health checks), upload , @@ -39,11 +46,12 @@ cmd_collect() { # Default values LOG_TAIL_SEC=30 + PASSWORD="" # Parse options while [ $# -gt 0 ]; do case "$1" in - --log-sec) + --log-sec|-s) if [ -z "$2" ] || [ "$2" -le 0 ] 2>/dev/null; then echo "Error: --log-sec requires a positive number" >&2 exit 1 @@ -51,9 +59,35 @@ cmd_collect() LOG_TAIL_SEC="$2" shift 2 ;; + --password|-p) + # If next arg exists and doesn't start with -, use it as password + if [ -n "$2" ] && [ "${2#-}" = "$2" ]; then + PASSWORD="$2" + shift 2 + else + # Prompt for password interactively from stdin, no echo! + # Disable echo BEFORE printing the prompt + old_stty=$(stty -g 2>/dev/null) + stty -echo 2>/dev/null || true + printf "Enter encryption password: " >&2 + read -r PASSWORD + echo "" >&2 + # Restore terminal settings + if [ -n "$old_stty" ]; then + stty "$old_stty" 2>/dev/null || true + else + stty echo 2>/dev/null || true + fi + if [ -z "$PASSWORD" ]; then + echo "Error: Empty password not allowed" >&2 + exit 1 + fi + shift + fi + ;; *) echo "Error: Unknown option '$1'" >&2 - echo "Usage: support collect [--log-sec N]" >&2 + echo "Usage: support collect [--log-sec|-s N] [--password|-p PASSWORD]" >&2 exit 1 ;; esac @@ -328,7 +362,22 @@ cmd_collect() # Create final tar.gz and output to stdout # Use -C to change to parent directory so paths in archive don't include full home path cd "${HOME}" - tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}" + + # Check if password encryption is requested + if [ -n "$PASSWORD" ]; then + if ! command -v gpg >/dev/null 2>&1; then + echo "Error: --password specified but gpg is not available" >&2 + exit 1 + fi + echo "Encrypting with GPG..." >&2 + tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}" | \ + gpg --batch --yes --passphrase "$PASSWORD" --pinentry-mode loopback -c 2>> "${EXEC_LOG}" + echo "" >&2 + echo "WARNING: Remember to share the encryption password out-of-band!" >&2 + echo " Do not send it in the same email as the encrypted file." >&2 + else + tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}" + fi } cmd_clean() @@ -408,17 +457,25 @@ usage() echo "Usage: support [options]" echo "" echo "Commands:" - echo " collect Collect system information for support/troubleshooting" - echo " NOTE: may take up to a minute to finish, please wait!" - echo " clean [options] Remove old support collection directories" + echo " collect [options] Collect system information for support/troubleshooting" + echo " NOTE: may take up to a minute to finish, please wait!" + echo " clean [options] Remove old support collection directories" + echo "" + echo "Options for collect:" + echo " -s, --log-sec SEC Tail /var/log/messages for SEC seconds (default: 30)" + echo " -p, --password [PASS] Encrypt output with GPG. If PASS is omitted, prompts" + echo " interactively or reads from stdin, so possible to do" + echo " echo "\$MYSECRET" | ... (recommended for security)" echo "" echo "Options for clean:" - echo " --dry-run, -n Show what would be deleted without deleting" - echo " --days N, -d N Remove directories older than N days (default: 7)" + echo " -n, --dry-run Show what would be deleted without deleting" + echo " -d, --days N Remove directories older than N days (default: 7)" echo "" echo "Examples:" - echo " support collect > support-data.tar.gz" - echo " ssh user@device support collect > support-data.tar.gz" + echo " support collect > support-data.tar.gz" + echo " support collect -p > support-data.tar.gz.gpg" + echo " support collect --password mypass > support-data.tar.gz.gpg" + echo " ssh user@device support collect > support-data.tar.gz" echo " support clean --dry-run" echo " support clean --days 30" exit 1