0

On a couple of our recent Catalyst 9k switches running IOSXE 17.3.x we've noticed a file with the name 'ssd' on the (boot)flash: filesystem.

switch#dir flash:
Directory of flash:/

270353  -rw-          5242880  May 13 2022 16:21:50 +02:00  ssd
...

On some of these switches this file, or at least the timestamp, seems to change frequently (daily) causing a diff in rancid. Currently we've modified the ios.pm code in rancid to filter this out for now. We'd like to upstream this patch if useful but first we'd like to know more about what this is used for. On first glance it seems to be a LUKS container but we can't seem to find any clue on what its exact use is.

switch#more flash:ssd
00000000:  4C554B53 BABE0001 61657300 00000000    LUKS :>.. aes. .... 
00000010:  00000000 00000000 00000000 00000000    .... .... .... .... 
00000020:  00000000 00000000 7874732D 706C6169    .... .... xts- plai 
00000030:  6E363400 00000000 00000000 00000000    n64. .... .... .... 
00000040:  00000000 00000000 73686132 35360000    .... .... sha2 56.. 
00000050:  00000000 00000000 00000000 00000000    .... .... .... ....
...

Anyone able to shed some light on this?

1
  • That's an encrypted filesystem in a file. I have no clue what would actually be using it. (enable the linux bash shell -- feature bash-shell?, and see where it's mounted?)
    – Ricky
    May 23 at 21:44

1 Answer 1

1

As we could not find any information on this we raised an informational support ticket with our VAR which got escalated to Cisco. The following is a summary of the information we were provided.

It seems this file is directly related to the Guest Shell functionality which is a virtualized Linux-based environment.

The name SSD comes from "secure storage disk".

This file appears on multiple (all?) Catalyst 9k's but does not behave the same on all platforms. In a labsetup (on a Catalyst 9500 probably?) they could confirm that it indeed gets updated daily without any other changes. This file however won’t be updated daily on a Catalyst 9200 as it has different app hosting capabilities then a Catalyst 9500. This last behaviour is also what we're seeing in the field with our Catalyst 9200's vs our Catalyst 9500's.

Some internal code snippets (shellscript probably):

function crypt_setup
{
    secure_storage_media="/flash"
    secure_storage_service="sss"
    secure_storage_disk="ssd"
    dmcrypt_disk="ss_disc"

Additionally, if the file is deleted/does not exist, then it will be generated again.

if [ ! -f "${secure_storage_disk}" ]; then
    dd if=/dev/zero of=./$secure_storage_disk bs=1M count=5
fi

At this moment this is not documented anywhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.