Skip to content

Zeroize (secure sanitize)

Zeroize removes secrets, credentials, keys, logs, recorded tracks, and device identity. It then issues TRIM, overwrites free space, and reboots to a clean first-boot state. Use it when you decommission a unit or when a unit is at risk of capture.

The device is not bricked. After zeroize, it reboots into a clean first-boot state. The device remains usable, but it contains no operator secrets. The prior pi password and every SSH authorized key stop working. AryaOS restores the published bootstrap password and expires it, so the next local or SSH login must replace it before administering the unit.

Flash-media limitation - read this before you rely on zeroize

On flash media (microSD, eMMC, NVMe) wear-leveling means overwriting a file or free space does not guarantee the prior contents are unrecoverable. The controller can have written your data elsewhere, and Old physical blocks can persist beyond the reach of software.

Zeroize removes secrets, shreds their current blocks, issues TRIM, and overwrites free space as a best effort - nothing more. It is honest hygiene, not a hardware guarantee.

For a hard guarantee, you need one of:

  • Full-disk encryption with key destruction (crypto-erase) - if the data was only ever written in encrypted form, erase the key. The data becomes unrecoverable, regardless of where the controller put the ciphertext. (Full-disk encryption is on the AryaOS roadmap as the stronger sanitization path.)
  • Physical destruction of the media - the only unconditional guarantee.

Treat zeroize as the software best-effort layer, not a substitute for crypto-erase or physical destruction when the threat model demands certainty.

What gets erased

Zeroize (/usr/local/sbin/aryaos-zeroize) shreds each file (single pass + zero - multi-pass is pointless on flash), then removes it. In order, it wipes:

Category What is destroyed
TLS / TAK key material /etc/aryaos/tls, /etc/cotbridge/tls, the per-gateway tls trees, the snakeoil key, and /etc/lighttpd/ssl.
SSH host keys Wiped, then regenerated (ssh-keygen -A) so SSH still works after the reboot.
VPN state tailscale logout, then /var/lib/tailscale wiped.
Node-RED credentials flows_cred.json wiped. admin password reset to a random, unrecorded value (rotate it from the web console after reboot).
Recorded tracks & local files /var/www/html/recorder (recorded CoT), /var/lib/aryaos/backups, /var/lib/aryaos/support, and the state JSON files.
Saved networks /etc/NetworkManager/system-connections and the comitup hotspot password - wiped by default (they hold PSKs). --keep-network preserves them.
Site configuration Shreds the operator copies of aryaos-config.txt and cotbridge.ini, then restores both packaged defaults. This removes secrets and the prior TAK Server hostname.
Login credentials & shell history Replaces and expires the pi password, locks root and other interactive local accounts, removes every SSH authorized key and lab-only sudo grant, and wipes root/per-user .bash_history.
Logs Rotates and vacuums journald (already RAM-volatile), then shreds anything on disk under /var/log.
Device identity Removes machine-id and firstboot markers so a new DEVICE_SUFFIX/hostname is derived on next boot.
Free space Fills each writable filesystem with zeros until full, deletes the fill, then runs fstrim -av to return blocks to the controller.

The free-space overwrite is the slow step - the command prints "overwriting free space (this can take a while)..." while it runs. When it finishes the box reboots into a clean first-boot state.

First login after zeroize

Use the published AryaOS bootstrap password and immediately choose a new password when prompted. Any password or SSH key that worked before the zeroize is intentionally invalid. A lab image also loses its lab key and passwordless-sudo exception. Zeroize returns it to the release access posture.

How to run it

  1. Open Cockpit > AryaOS Site > Zeroize.
  2. The card requires you to type a confirmation phrase - this is destructive and irreversible, so there is no single-click path.
  3. Confirm. The card runs the wipe (--service), overwrites free space, and The box reboots clean.
sudo aryaos-zeroize                  # wipe everything incl. saved networks, then reboot
sudo aryaos-zeroize --keep-network   # preserve saved Wi-Fi/NetworkManager connections
sudo aryaos-zeroize --no-reboot      # do the wipe but stay up (testing)

Interactively, zeroize requires you to type an explicit phrase to proceed:

!!! ZEROIZE: this destroys all keys, credentials, logs, tracks, and
!!! identity on aryaos-1a2b and reboots it to a clean state.
Type ERASE aryaos-1a2b to proceed:
Flag Effect
(none) Wipe everything, including saved networks, then reboot.
--keep-network Preserve saved Wi-Fi/NetworkManager connections (they contain PSKs - only for a box you are keeping on your own network).
--service Non-interactive (used by the Cockpit card, which required the confirmation phrase).
--no-reboot Do the wipe but do not reboot - for testing.

Zeroize vs. factory reset

Zeroize is the secure counterpart to a factory reset. Factory reset restores config to defaults for re-use and keeps the network by default. Zeroize destroys everything for decommission and wipes the network by default. If the box will leave your control, use zeroize. See the comparison table.

  • Factory reset - the non-destructive clean-slate counterpart. Factory reset
  • Security posture - where zeroize fits in decommissioning. Security posture
  • CLI helpers - the full aryaos-zeroize reference. CLI helpers