Data anonymization

RADKit Service can anonymize selected values in command output before returning it to a RADKit Client. This is useful when command output needs to be shared or stored outside the managed environment without disclosing IPv4/IPv6 addresses, network addresses, email addresses and fully qualified domain names (FQDN).

Warning

Data anonymization currently has limited configuration options and scope:

  • It applies only to output returned by command execution (exec), including streamed command output.

  • It does not anonymize command input, interactive terminal sessions, other device capabilities, Service logs, or data stored on a device.

  • When activated, it applies to all remote users and devices indiscrimately.

Anonymized data

The Service looks for the following values in command output:

  • IPv4 and IPv6 addresses, with optional CIDR prefixes, e.g.

    • 10.10.0.5 (IPv4 address)

    • 10.10.0.0/16 (IPv4 network address)

    • 10.10.0.0 255.255.0.0 (IPv4 network address with mask)

    • 10.10.0.0 0.0.255.255 (IPv4 network address with reverse mask)

    • 2001:db8::1 (IPv6 address)

    • 2001:db8::/32 (IPv6 network)

  • fully qualified domain names (FQDNs)

  • email addresses

The same key produces deterministic replacements. IPv4 and IPv6 replacements preserve prefixes, so addresses from the same network retain their network relationship after anonymization. FQDNs retain their top-level domain, while email addresses retain their general structure.

Some values are intentionally left unchanged:

  • IPv4 loopback (127.0.0.0/8), unspecified (0.0.0.0/8), link-local (169.254.0.0/16), multicast (224.0.0.0/4), and broadcast (255.255.255.255) addresses

  • IPv6 loopback (::1/128), unspecified (::/128), link-local (fe80::/10), and multicast (ff00::/8) addresses

  • IPv4 wildcard masks, such as 0.0.0.255

  • IPv4 network masks, such as 255.255.0.0

Text that does not match one of these patterns, including interface names, plain hostnames, serial numbers, and arbitrary identifiers, is not anonymized. Review output before sharing it when it may contain other sensitive information.

Service configuration

Data anonymization is disabled by default. Configure it in the RADKit Service WebUI under Settings, or add the following to the Service settings.toml file:

[service.data_anonymization]
enabled = true
key = "use-a-long-random-secret"

Both enabled and a non-empty key are required. The key determines the replacement values and should be generated and handled like a password. Keep the same key when stable replacements are required across Service restarts or instances.

Warning

Do not commit the key to version control or distribute it with anonymized output. Anyone with the key can reproduce replacements for candidate values.

For the complete list of options and ways to set them, see Service settings and Settings management. The corresponding environment variables are RADKIT_SERVICE_DATA_ANONYMIZATION_ENABLED and RADKIT_SERVICE_DATA_ANONYMIZATION_KEY.

Caching replacements

Replacement caching keeps a mapping in Service memory from each original value to its anonymized value:

[service.data_anonymization]
enabled = true
key = "use-a-long-random-secret"
caching_enabled = true

Caching is not required for deterministic replacements. Enable it when the mapping must be synchronized to a file or when custom replacements are needed.

Synchronizing replacements

The Service can periodically synchronize cached replacements with a JSON file:

[service.data_anonymization]
enabled = true
key = "use-a-long-random-secret"
caching_enabled = true
sync_enabled = true
sync_file_name = "data_anonymization_sync.json"
sync_period = 5.0

sync_file_name can be an absolute path. In settings.toml, a relative path is resolved from the Service directory. For environment variables and command-line settings, it is resolved from the current working directory. sync_period is the synchronization interval in seconds. The file can also be populated with custom original-to-replacement mappings; these mappings are loaded into the cache during synchronization.

Danger

The synchronization file contains original values and their replacements in plain text. Restrict access to the file and its backups. Do not share it with anonymized output.

The file also contains a salted hash used to detect a change of key; it does not contain the key itself. If the file is invalid or its key hash no longer matches, the Service writes a numbered .bak backup and creates a new file.

Changing the key changes newly generated replacements. Existing mappings in memory or in the synchronization file require separate handling and may retain values generated with the previous key. Treat the key and synchronization file as persistent configuration. To rotate the key, stop the Service, secure or remove the old synchronization file and its backups, then restart the Service with the new key.

Client operation

No Client configuration is required. Once anonymization is enabled on the Service, calls to Device.exec() return anonymized command output:

>>> response = service.inventory["router1"].exec("show ip route").wait()
>>> response.data | print
Gateway of last resort is 53.166.14.241 to network 0.0.0.0

The command sent to the device is unchanged. Only output processed by the Service on its way back to the Client is anonymized. See Command execution for details about command execution.