Readers will learn how to properly format and sanitize EdgeRouter configurations to remove all personal and sensitive information.
NOTES & REQUIREMENTS:
Applicable to the latest EdgeOS firmware on all EdgeRouter models. Please see the Related Articles below for more information.
Table of Contents
Downloading the Configuration from the EdgeRouter
The first step is to download the backup archive from the EdgeRouter using the Web UI.
GUI: Access the EdgeRouter Web UI.
1. Navigate to the System tab in the bottom-left of the GUI to download the backup configuration archive.
System > Configuration Management & Device Maintenance > Back Up Config
2. Download the backup config file by clicking on the Download button.
3. The EdgeRouter will prompt you to save the archive on your computer.
NOTE: The EdgeRouter startup configuration file (config.boot) is included in an archive called edgeos_hostname_yyyymmdd.tar.gz.
4. Open the edgeos_hostname_yyyymmdd.tar.gz archive using a file archival program such as 7-Zip.
5. Extract the config.boot file from the archive.
Sanitizing the Configuration
Now we can modify the contents of the config.boot file in order to sanitize (obscure) any sensitive information. Some examples are:
Public IP addresses
UNMS connection info
Commit archival location
Custom banner message
1. Open the config.boot file using a text editor.
2. Look for any public IP addresses to obscure. Notable configuration areas are the interfaces and firewall sections.
A good way to sanitize IP addresses, while maintaining readability, is to keep the values unique or only obscure part of the address. Instead of replacing each address with
y.y.y.y, a better way is to obscure part of the address (
y.y.y.29 for example) or completely replace it with a RFC5737 documentation address. The documentation range IP addresses are:
192.0.2.0 - 192.0.2.255
198.51.100.0 - 198.51.100.255
203.0.113.0 - 203.0.113.255
NOTE: It is generally not needed to obscure private IP addresses. The private IP address ranges defined in RFC1918 are:
3. Look for any usernames or passwords to obscure. Notable configuration areas are the vpn and system sections.
4. Save the edited config.boot file.