Maintenance#
All the components of SecureDrop are designed to run with as little need for maintenance as possible. Nevertheless, there are times when manual intervention is necessary.
SecureDrop updates#
The Administrator should be aware of all SecureDrop updates and take any required manual action if requested in the SecureDrop Release Blog (RSS feed). We also recommend making contact with SecureDrop support via Signal, so that we may let you know in advance of major releases if manual intervention will be required. Administrators should verify that the Servers and Workstations stay up-to-date and troubleshoot any issues with updates by following the instructions on the following pages.
BIOS updates#
The hardware used for the SecureDrop servers and Workstations will have underlying BIOS firmware provided by the hardware manufacturer. Keeping this firmware up-to-date is essential for maintaining the security of the devices that make up your SecureDrop.
Network Firewall updates#
Given all traffic first hits the network firewall as it faces the non-Tor public network, the Administrator should ensure that critical security patches are also applied to the firewall.
Refer to the respective sections Keeping pfSense up to date or Keeping OPNSense up to date if you used one of our recommended firewalls. Otherwise, consult your firewall manufacturer’s documentation.
Back up and restore#
All types of Workstations and the Application Server can be backed up and restored if necessary. It is also possible to rebuild the Admin Workstation from an existing Application Server and Journalist Workstation.
Alerts and logs#
Both SecureDrop Servers and Workstations produce logs which can be useful for investigating problems and troubleshooting.
Warning
Logs and alerts can contain sensitive information. Do not share logs outside your organization without first carefully examining them and redacting any sensitive information.
SecureDrop uses OSSEC to monitor the servers for unusual activity caused by system configuration issues or security breaches. The Administrator should decrypt and read all OSSEC alerts. See the OSSEC Guide for more information on how to interpret OSSEC alerts.
Troubleshooting#
Troubleshooting steps and fixes are provided for some of the most common issues you may encounter using the different components of SecureDrop:
Decommissioning SecureDrop#
Special steps should be followed if your SecureDrop needs to be temporarily shut down, moved, or permanently decommissioned. These steps are outlined on the Decommission SecureDrop page.