linuxexpert-practice-labs/labs/lfca/4-2-sensitive-data/README.md

LFCA 4.2: Sensitive data

A secret committed to Git and taken out of its history again, and a file encrypted before its original is shredded.

Before you start

Work as root (sudo -i). The lab installs Git if it's missing and creates a test repository, /root/leaky, in which someone committed a file config.env with a fake API key, and later commits on top. It also creates /root/customers.csv. It notes which packages were installed, and reset puts that back. The VM needs internet access to install the tools.

Tasks

1. Find the key in /root/leaky with gitleaks detect (from Ubuntu's packages; on the RHEL family, the upstream release) or with git log -p | grep. Then remove config.env from the whole history with git filter-repo --force --path config.env --invert-paths, keeping the other files and commits. Note why the key would still need to be rotated.
2. Encrypt /root/customers.csv with gpg -c, and delete the original with shred -u. Then read man shred and note why it isn't reliable on SSDs or on copy-on-write filesystems such as Btrfs.

Hints

• cd /root/leaky, git log --oneline --stat, git log -p | grep -i key.
• apt install gitleaks git-filter-repo on Ubuntu. On the RHEL family, git-filter-repo is in EPEL (dnf install epel-release, then dnf install git-filter-repo).
• After filter-repo, git log --all --oneline -- config.env shows nothing.
• gpg -c customers.csv asks for the passphrase twice; ls after shred -u.