{"id":15,"date":"2014-05-26T08:13:00","date_gmt":"2014-05-25T22:13:00","guid":{"rendered":"https:\/\/www.serenux.com\/?p=15"},"modified":"2021-01-11T09:17:33","modified_gmt":"2021-01-10T23:17:33","slug":"howto-setup-dariks-boot-and-nuke-dban-to-automatically-erase-storage-devices-via-pxe-boot","status":"publish","type":"post","link":"https:\/\/www.serenux.com\/index.php\/2014\/05\/26\/howto-setup-dariks-boot-and-nuke-dban-to-automatically-erase-storage-devices-via-pxe-boot\/","title":{"rendered":"HowTo: Setup Darik\u2019s Boot and Nuke (DBAN) to automatically erase storage devices via PXE boot"},"content":{"rendered":"\n<p>Darik\u2019s Boot and Nuke (abbreviated as DBAN) is a popular tool used by many organisations and individuals to securely erase hard-drives prior to disposal, or perhaps just to fix Windows problems&nbsp;<img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20150206041146im_\/http:\/\/www.serenux.com\/wp-content\/themes\/grey-opaque\/images\/smilies\/icon_wink.gif\" alt=\"Smilie: ;)\">&nbsp;. It typically comprises a small 15MB ISO image that you can burn to CD or make a bootable USB stick from so you can boot up a PC on it and set about erasing all detected storage devices.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><a href=\"https:\/\/web.archive.org\/web\/20150206041146\/http:\/\/www.serenux.com\/wp-content\/uploads\/2014\/05\/EraseHDD.png\"><img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20150206041146im_\/http:\/\/www.serenux.com\/wp-content\/uploads\/2014\/05\/EraseHDD.png\" alt=\"Erase HDD\" class=\"wp-image-896\"\/><\/a><\/figure><\/div>\n\n\n\n<p>When you\u2019re doing a lot of machines, however, booting a CD is tedious, especially when you accidentally scratch the disc and need to burn a new one. Using a USB stick and either misplacing it, or forgetting to remove it before erasing starts means you&nbsp;lose the content of the boot stick too.<\/p>\n\n\n\n<p>Wouldn\u2019t it be nice to be able to simply boot DBAN from the network so it\u2019s always available whenever you need it and have it automatically use your preferred options instead of being manually run each time?<\/p>\n\n\n\n<p><strong><em>Pre-requisites<\/em><\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A copy of DBAN. You can get it from the project site\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/web.archive.org\/web\/20150206041146\/http:\/\/www.dban.org\/download\" target=\"_blank\">here<\/a>. I will be using version 2.2.8 in this article.<br><\/li><li>A working Linux PXE server. If you\u2019ve not built one before, you can use my previous guide\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/web.archive.org\/web\/20150206041146\/http:\/\/www.serenux.com\/2010\/05\/howto-setup-your-own-pxe-boot-server-using-ubuntu-server\/\" target=\"_blank\">here<\/a>.<br><\/li><li>A sacrificial hard-drive or a virtual machine to test with. You will be completely destroying the data on the drive. When this exercise is over, there will be nothing recognisable on the drive so operating systems will typically recognise the drive as a brand new, never-before-used drive.<br><\/li><li>The\u00a0PC housing the sacrifical drive needs to have the ability to boot from PXE. All modern computers built in the last 15 years\u00a0should be able to do this.<\/li><\/ul>\n\n\n\n<p><strong><em>Let\u2019s get it&nbsp;going<\/em><\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>First up, we need to extract DBAN\u2019s files from the ISO image since we\u2019re not going to burn it to a disc. Open the downloaded ISO image in Archive Manager by right-clicking on it and choose\u00a0<em>\u201cOpen with Archive Manager\u201d<\/em>.<br><\/li><li>Extract the following files:\u00a0<em>DBAN.BZI<\/em>\u00a0and\u00a0<em>ISOLINUX.CFG<\/em><br><\/li><li>On your PXE\u00a0server, assuming you have all your files under \/srv\/tftp as per my previous tutorial, make a new folder called\u00a0<em>\u201cdban\u201d<\/em>\u00a0under it:<br><br><code>$ mkdir \/srv\/tftp\/dban<\/code><br><\/li><li>Now copy over the DBAN.BZI file you extracted in Step 1 to the \/srv\/tftp\/dban directory. You don\u2019t need to copy ISOLINUX.CFG because we\u2019re simply using that for boot command reference.<br><\/li><li>Now rename the file so that it\u2019s all in lowercase:<br><br><code>$ mv \/srv\/tftp\/dban\/DBAN.BZI \/srv\/tftp\/dban\/dban.bzi<\/code><br><br>(We don\u2019t actually\u00a0need to do this, but since everything else in the Linux world is typically in lower-case, we may as well do the same here)<br><\/li><li>Now make sure that the permissions are set for TFTP correctly:<br><br><code>$ sudo chmod 777 -R \/srv\/tftp<\/code><br><\/li><li>Now let\u2019s setup a simple PXE menu boot option that is simply going to write zeros across all detected storage devices when you boot up on it (which is the fastest method of wiping while remaining secure). Open your PXE boot menu config file. If using my previous tutorial, then that will be:<br><br><code>$ nano \/srv\/tftp\/mybootmenu.cfg<\/code><br><\/li><li>Scroll to the bottom (or insert where you\u2019d like to have it) and add the following lines:<br><br><code>LABEL Auto ^Nuke EVERYTHING With Zeros NOW! No Questions Asked!<br>KERNEL dban\/dban.bzi APPEND nuke=\"dwipe --autonuke --method zero\" silent<\/code><br><\/li><li>Press CTRL+X, then Y and then Enter to save your changes.<br><\/li><li>Boot up your sacrificial system into PXE. When your menu appears, you should see a new entry called\u00a0<em>\u201cAuto Nuke EVERYTHING With Zeros NOW! No Questions Asked!\u201d<\/em>\u00a0and the \u201cN\u201d\u00a0character will be highlighted to indicate the keyboard shortcut for it.<br><\/li><li>Use the arrow keys or the keyboard shortcut to launch DBAN. It should boot quite quickly since it\u2019s such a small application.<br><\/li><li>You will see a lot of text appear while the system boots up, enumerating hardware and searching for storage devices. At this time, any attached direct-writable storage mediums such as hard-drives and USB sticks will become targets for DBAN. Network drives\/shares and other PC\u2019s on your network will <em>not<\/em> become targets.<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20150206041146im_\/http:\/\/www.serenux.com\/wp-content\/uploads\/2014\/05\/DBAN_Booting.png\" alt=\"DBAN_Booting\"\/><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\" start=\"13\"><li>Once the system has detected everything it can find, DBAN will begin.\u00a0All detected storage devices will be listed on their own line and will show their erasure status. You will notice that all this starts automatically and with no further interaction from you.<br><\/li><li>Once the system has completed erasing all devices, it will advise accordingly and halt the system. Your drives are now securely erased!<\/li><\/ol>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20150206041146im_\/http:\/\/www.serenux.com\/wp-content\/uploads\/2014\/05\/DBAN_Finished.png\" alt=\"DBAN_Finished\"\/><\/figure><\/div>\n\n\n\n<p><strong><em>Additional&nbsp;Options<\/em><\/strong><\/p>\n\n\n\n<p>So you might be wondering, what did we need the ISOLINUX.CFG file for if we weren\u2019t going to use it? Will, this is just for your reference \u2013 it contains all the command line parameters for all of the other&nbsp;options that DBAN offers you for the truly paranoid data hoarder.&nbsp;<em>Please note that these additional&nbsp;options are superfluous \u2013 hard-drives are magnetic devices that can only hold one set of ones and zeros.&nbsp;Overwriting the drive multiple times with sequential or random ones and zeros is not going to make the erasure any more or less secure. Once a drive is wiped with just&nbsp;one pass of ones or zeros or a random combo, it is&nbsp;impossible to recover any data from it, and you certainly cannot \u201cunformat\u201d it or \u201cunwipe\u201d it.<\/em><\/p>\n\n\n\n<p>To save you some time, here\u2019s a complete list of the extra options presented as a sub-menu for your PXE boot menu. Simply copy and paste it into your boot menu configuration, or pick and choose the options you want.<\/p>\n\n\n\n<p>Note: To prevent accidental erasing of a system from PXE boot, the default menu option is set to run DBAN in manual mode where you are asked to choose which drives you wish to erase, which gives you a chance to back out.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># ================================================================\n# BEGIN: SECURE HDD ERASE OPTIONS\n# ================================================================\n\nmenu begin Secure HDD erase options\n menu title ^Secure HDD erase options\n label mainmenu\n menu label ^Back..\n menu exit\n\nLABEL Auto ^Nuke EVERYTHING With Zeros NOW! No Questions Asked!\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method zero\" silent\n\nLABEL ^Manual Setup of Wipe Options\n MENU default\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe\"\n\nLABEL ^Default 3-Pass Random Wipe (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke\" silent\n\nLABEL US Dept Defence ^Standard Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method dod522022m\" silent\n\nLABEL US Dept Defence ^3-Pass Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method dod3pass\" silent\n\nLABEL US Dept Defence Short Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method dodshort\" silent\n\nLABEL Peter ^Gutmann Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method gutmann\" silent\n\nLABEL ^RCMP TSSIT OPS-II Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method ops2\" silent\n\nLABEL ^Paranoid 8x Wipe with Full Verify (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method prng --rounds 8 --verify all\" silent\n\nLABEL PRNG Stream ^8x Wipe Method (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method prng --rounds 8\" silent\n\nLABEL ^Quick Wipe - Not 100% Secure (AUTO)\n KERNEL dban\/dban.bzi\n APPEND nuke=\"dwipe --autonuke --method quick\" silent\n\nmenu end\n\n# ================================================================\n# END: SECURE HDD ERASE OPTIONS\n# ================================================================<\/pre>\n\n\n\n<p>Happy erasing!&nbsp;<img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20150206041146im_\/http:\/\/www.serenux.com\/wp-content\/themes\/grey-opaque\/images\/smilies\/icon_smile.gif\" alt=\"Smilie: :)\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Darik\u2019s Boot and Nuke (abbreviated as DBAN) is a popular tool used by many organisations and individuals to securely erase hard-drives prior to disposal, or perhaps just to fix Windows problems&nbsp;&nbsp;. It typically comprises a small 15MB ISO image that you can burn to CD or make a bootable USB stick from so you can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-15","post","type-post","status-publish","format-standard","hentry","category-tutorials"],"_links":{"self":[{"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/posts\/15","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/comments?post=15"}],"version-history":[{"count":1,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/posts\/15\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/posts\/15\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/media?parent=15"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/categories?post=15"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serenux.com\/index.php\/wp-json\/wp\/v2\/tags?post=15"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}