Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -1 down vote favorite

Just curious what do you guys use for file or database encryption? Any good programs out there or techniques employed for securing IT personal information? Main reason is the company I work for has incredible too many IT passwords, which is good and bad, but the director would like to be able to store them all on a heavily encrypted file. Options?

share|improve this question
Generally speaking, you want to avoid open-ended or "recommend x" type questions. If you are unsure, you should read the faq as to why this type of question is generally not well accepted here. – MDMarra Nov 11 '11 at 18:24

closed as not constructive by MDMarra, Scott Pack, MadHatter, John Gardeniers, voretaq7♦ Nov 16 '12 at 16:58

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

4 Answers

up vote 2 down vote accepted

While it does not directly address the file / database encryption the title indicates I will heartily recommend the use of KeePass for storage and retrieval of IS passwords and account data. My organization recently went from an old word document system to this product and we are thrilled with the results.

Although it is designed for passwords is it has the ability to add multiple additional fields. This comes in handy for notes, multiple domains, etc. This has proven really handy for segregating our DMZ from internal network, etc. I use the Windows release but there are also releases available multiple additional platforms.

share|improve this answer
That seems very simple and lightweight, have you noticed any potential security issues with this software? This is essentially exactly what I need =) – 1Tguru4l1f3 Nov 11 '11 at 15:44
I second the Keepass recommendation. The main problem I've encountered with it is that it lakes internal ACLs and multiple logons. If you have several IT folks using a central Keepass database, this can lead to security issues (segregation of duties and accountability). Typically not a problem for small teams, though. – Stephane Nov 11 '11 at 15:48
Ya there are only 3 of us so I don't see that being a big issue, but essentially two users cannot access this at the same time? – 1Tguru4l1f3 Nov 11 '11 at 15:50
@Stephane - Agreed on the ACL issue, however setting up multiple database files is a decent workaround. – Tim Brigham Nov 11 '11 at 17:16
up vote 1 down vote

I would create my own in-house application (web, c#, java, etc.) which would store all the passwords in one database, along with who has access to use them. Then, I would provide access to these passwords by authenticating the user with the company account (I presume this exists, either by in-house method, active directory, LDAP, etc.). When authenticated to the system, it would act as intermediary between them and whatever they are authenticating to.

I know it's a bit of a pain to do things in house, but often it does exactly what the boss needs, and in my experience, if it's documented enough, will last a long time.

share|improve this answer
That sounds really good, if he allotted enough time to build an application this would be a great approach. In all reality even building this is PHP or java would not be a complicated tasks, but you know how it goes sometimes the boss just wants something now. Do you have any good sites about building apps and integrating active directory into usage rights? Really all it would be is setting the permissions on running the app right? – 1Tguru4l1f3 Nov 11 '11 at 15:47
Also, if that's the case would you just be creating the app to encrypt the data with the latest and greatest encryption schemes? Because if you are going to use AD to set permissions you could technically just do that on a word document though I do not think that would be very secure. Thanks for the feedback! – 1Tguru4l1f3 Nov 11 '11 at 15:49
The app would have a built-in authentication 'page', such as a web site, Email or IM application. As for encryption, 'Blowfish' is supposed to be the top dog. For its simplicity, I favor seccure: point-at-infinity.org/seccure – djhaskin987 Nov 11 '11 at 16:31
up vote 0 down vote

I use GNU Privacy Guard (gpg) for file encryption. It has the advantages of being free, multiplatform, decentralised, and lightweight. You can encrypt files to the set of keys that are appropriate for the contents.

Since people are responsible for their own keys (decentralised) it also provides a handy authentication-and-encryption channel when people are apart. Although I set it up with my clients' admins primarily for encrypting the shared password files, I've often been grateful when out and about, and in receipt of an email from one of those admins asking me to (eg) reboot a server, that I can be sure that (a) it really was sent by the chap it claims to be from, (b) it hasn't been altered in transit, and (c) if the instruction was sent in error I can prove to a third-party that it wasn't my error.

As for database encryption, I'd probably encrypt the underlying disc volumes with (eg) dm_crypt and take the database out of the loop altogether.

share|improve this answer
great! GNU Privacy Guard sounds great. I am mainly looking for file encryption, but looking at the available options. – 1Tguru4l1f3 Nov 11 '11 at 15:34
If you already know this, forgive me for adding it, but once you have a preferred answer it's the done thing to "accept" it by clicking the tick outline next to that answer. That drives the reputation mechanism for the site, and stops the question floating back to the top of the "unanswered" lists. – MadHatter Nov 11 '11 at 16:42
I did not know that as I am fairly new to this site, thank you for that... though I would like to see if there are any other options out there before I close it. I do have another one that needs to be closed though. Thanks =) – 1Tguru4l1f3 Nov 11 '11 at 16:46
up vote 0 down vote

Encrypting the database files, directory or partition helps nothing. The database software needs encrypted access and hackers use SQL connection to talk to unencrypted database.

You need to store all the relevant information in database as encrypted and fetch in encrypted mode back to the software. Inside your software you then decrypt them. Where you store this password is up to you. Some even require password on server boot, but if you store it on HDD or even on USB stick it can be read by unauthorized code.

On boot your software can wait for a browser user to input the password. Then it would be stored in memory until next boot. Depends on your software of course.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.