What is the ssd LUKS file on the (boot)flash of newer 9k Catalyst switches?

Question

On a couple of our recent Catalyst 9k switches running IOSXE 17.3.x we've noticed a file with the name 'ssd' on the (boot)flash: filesystem.

switch#dir flash:
Directory of flash:/

270353  -rw-          5242880  May 13 2022 16:21:50 +02:00  ssd
...

On some of these switches this file, or at least the timestamp, seems to change frequently (daily) causing a diff in rancid. Currently we've modified the ios.pm code in rancid to filter this out for now. We'd like to upstream this patch if useful but first we'd like to know more about what this is used for. On first glance it seems to be a LUKS container but we can't seem to find any clue on what its exact use is.

switch#more flash:ssd
00000000:  4C554B53 BABE0001 61657300 00000000    LUKS :>.. aes. .... 
00000010:  00000000 00000000 00000000 00000000    .... .... .... .... 
00000020:  00000000 00000000 7874732D 706C6169    .... .... xts- plai 
00000030:  6E363400 00000000 00000000 00000000    n64. .... .... .... 
00000040:  00000000 00000000 73686132 35360000    .... .... sha2 56.. 
00000050:  00000000 00000000 00000000 00000000    .... .... .... ....
...

Anyone able to shed some light on this?

Answer 1

As we could not find any information on this we raised an informational support ticket with our VAR which got escalated to Cisco. The following is a summary of the information we were provided.

It seems this file is directly related to the Guest Shell functionality which is a virtualized Linux-based environment.

The name SSD comes from "secure storage disk".

This file appears on multiple (all?) Catalyst 9k's but does not behave the same on all platforms. In a labsetup (on a Catalyst 9500 probably?) they could confirm that it indeed gets updated daily without any other changes. This file however won’t be updated daily on a Catalyst 9200 as it has different app hosting capabilities then a Catalyst 9500. This last behaviour is also what we're seeing in the field with our Catalyst 9200's vs our Catalyst 9500's.

Some internal code snippets (shellscript probably):

function crypt_setup
{
    secure_storage_media="/flash"
    secure_storage_service="sss"
    secure_storage_disk="ssd"
    dmcrypt_disk="ss_disc"

Additionally, if the file is deleted/does not exist, then it will be generated again.

if [ ! -f "${secure_storage_disk}" ]; then
    dd if=/dev/zero of=./$secure_storage_disk bs=1M count=5
fi

At this moment this is not documented anywhere.