Support bundle

It contains:

• Every username ever submitted to this box, including failed sign-ins. Usernames are never redacted, so a password mistyped into the username field is in the archive.
• The management source IP of every operator session.
• /var/log/authlog unredacted — the log viewer masks this file; the archive does not, and nothing clamps its content at write time because it is base-OS sshd/su/doas output.
• An inventory of which secrets exist for which peers. The values are not included, but the references embed WireGuard peer public keys, BGP neighbour addresses and IPsec EAP usernames.
• Alert channel names, mail recipients, and whether each channel carries a bearer token. The webhook URL itself is removed from every archive — for Slack, Discord and Teams that URL is the posting credential, so it is not something to send off the box. Note the archive records nothing about whether a channel had a URL at all.
• On a box whose DNS, DHCP or BGP configuration has not been adopted, the raw unbound.conf / dhcpd.conf / bgpd.conf bodies, filtered only by length.
• The declared management network, firewall table entries and rule comments, and the paths (not contents) of IPsec key files.
• The head of this boot’s kernel message buffer (system/dmesg_boot.json): the full hardware inventory — device serial numbers, CPU and board identifiers, and NIC MAC addresses with their device models, including interfaces the ARP table never shows.
• The persisted boot order, each daemon’s boot self-check record, and the drift manifest’s own load verdict (system/host_facts.json).

Not included: OgmaProtect’s own private keys of any kind (WireGuard, IPsec, TLS), the user database or any of its siblings, the last-good configuration tree, /etc/ssl/private, capability keys, core-dump contents, rotated .gz log history, and packet captures. Note the raw third-party config bodies above are only partly filtered for secrets — a brownfield dhcpd.conf or unbound.conf can carry TSIG keys that nothing in this product redacts. The bgpd.conf and ospfd.conf bodies do have their key-bearing directives redacted, but that is a triage courtesy rather than a security control: a key held in a file the configuration includes is not covered.

This tab always produces a partial archive — 39 sections against the console’s 41. Config-integrity and schema-state can only be read from the machine’s own console, so they are reported as omitted here. This is permanent and does not depend on your account. For the complete 41-section artifact, run ogmaprotectctl support-bundle --out <path> on the box.

Collecting takes the configuration-apply lock for as long as it runs. While it does, a restore, firewall apply or routing change is refused with “another apply is in progress” — and if one of those is already running, your collection is refused the same way. Neither queues; press Collect again.

Downloading removes your copy from the web tree immediately. The original stays on the box, readable only by root, and is deleted about an hour after it was collected. Downloads have their own budget of twenty per hour, per account.