The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
20 views

Firmware RAID5 and SED on Linux

I have three HDD's (Seagate ST4000NM0053) in a RAID5 set-up using firmware RAID (RSTe 4.0, Intel® C612 chipset) on Debian 8.4. They are SED, so I would like to set the ATA password. Unfortunately, my ...
1
vote
0answers
8 views

Can EFI/UEFI theoretically steal LUKS password? [migrated]

I usually keep my data private by encrypting the whole hard drive. My previous notebook had BIOS, without UEFI. I have bought macbook, want to install linux in dualboot there. So I wonder if EFI can ...
0
votes
1answer
19 views

Shrink non-bootable LUKS LVM

I'm importing a VMWare OVA whose second disk uses LUKS and configured to use 1TB of space, although its VMDK is only 30GB. I want to shrink this down. I am following the instructions here ...
3
votes
1answer
358 views

Cryptsetup luks - Check that kernel supports aes-xts-plain64 cipher

I encrypted a bunch of hard drives with cryptsetup luks encryption on CentOS 5. Everything was fine, until I upgraded my system to CentOS 6. Now I cannot mount the disks anymore. To mount with my ...
3
votes
0answers
47 views

Can servers with encrypted root filesystems be made reasonably highly available?

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
7
votes
1answer
160 views

LUKS Error During Boot

I only see this error on the console during the boot process of virtual machines we create. EDIT: 2/5/16 - I see it on some bare-metal installations, too. (It does proceed to boot completely.) I ...
3
votes
2answers
129 views

eCryptfs headers errors

I'm getting the following error on a server where a partition is encrypted thru ecryptfs. [3440851.003561] Valid eCryptfs headers not found in file header region or xattr region, inode 22545087 ...
3
votes
0answers
30 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
0
votes
1answer
51 views

cryptsetup luksOpen key-file does not work

I am getting "No key available with this passphrase." when trying: sudo cryptsetup open --type luks /dev/sdc storage --key-file=/path/to/keyfile The /path/to/keyfile file contains just the ...
0
votes
1answer
105 views

Remove McAfee branding from Windows login

McAfee Enterprise plasters its brand over everything on the PC. Everything. The latest is that since installing disk encryption, the McAfee logo is placed over the user account picture on the ...
-1
votes
2answers
51 views

How can I protect business data from being removed by an employee using encryption? [closed]

I am looking to beef up security on an office network. Aside from the obvious: physical security, limiting user privileges using Active Directory, running a firewall that does stateful packet ...
0
votes
0answers
7 views

Get timestamp of last luks encryption key slot change

I cannot find anything related in the documentation of luks. Is it possible to see when the given Key Slot was last changed (ie. when the user changed his password)?
-2
votes
1answer
77 views

how do I LUKS encrypt a drive that already has data?

On a CentOS 7 server, I would like to LUKS encrypt the entire hard drive, including a 50GB partition that has already received yum install and a few other updates, but nothing else. But this tutorial ...
0
votes
1answer
50 views

Encrypted Ubuntu 14.04 File / LAMP Server

I have a question regarding the safest method to encrypt a file and/or a LAMP server using Ubuntu 14.04. When manually partitioning the disk, I chose the following: /boot - 256 MB / - 51.4 GB ...
1
vote
1answer
76 views

Can cryptsetup read mappings from /etc/crypttab?

I have a virtualized CentOS 7 server that needs to mount multiple password-protected encrypted volumes. I cannot automatically map the devices on boot, because I don't have access to the console ...
2
votes
1answer
136 views

Replacing a Self encrypting Hard Drive in an IBM xseries server raid

I have a failed drive in a RAID 5 array in an IBM x3650, Machine Type 7945. The RAID is composed entirely of original IBM SED SAS drives, 300GB ea. Unfortunately I am the purchasing Tech, not the ...
0
votes
1answer
96 views

Is mounting /boot in /etc/fstab automatically necessary?

Hello members of StackExchange, I am running a Debian 8.0 server with Full-Disk-Encryption and while I was doing some hardening I went through the /etc/fstab and I was wondering if some partitions ...
2
votes
1answer
1k views

How to send “ATA Secure Erase” command to SSD?

A very good way to erase a SSD which have SED support is to change the password/key. But what to do with those that doesn't have SED support? This article says Fortunately it is possible to erase ...
0
votes
1answer
47 views

Unable to perform enable-bitlocker and lock-bitlocker successively

I am trying to enable bitlocker on windows server 2012 R2 data volume using following command: Enable-BitLocker -MountPoint $volume -Password ($password | ConvertTo-SecureString -AsPlainText -Force) ...
2
votes
1answer
672 views

How can I input password to manage-bde -pw option via windows powershell

I am trying to encrypt Data volume (for example E:) with the following command: manage-bde -protectors -add E: -pw When I execute the above command, it will ask for the password, so I entered it. ...
0
votes
1answer
32 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
0
votes
0answers
23 views

Encrypt ubuntu 14.04 home directory with services accessing them without login

I have few services which gets started as soon as server boots up. Now i would like to encrypt my home directory. Will services work properly if i do so? Code for those services is present in the home ...
1
vote
2answers
171 views

LUKS/dm-crypt security in the case of a break-in

This is an encryption topic I've been confused by for a while now. From what I understand of LUKS, once the LUKS volume is opened with a passphrase and the resulting device mapper device is mounted, ...
1
vote
1answer
122 views

BitLocker Already Configured Issue

System Configuration: Windows Server 2008 R2 Standard Disk Configuration: RAID1 We have a newly built system that is joined to a domain and has the proper GPOs for BitLocker already setup. We ...
0
votes
1answer
425 views

Preeseding a debian stable install with a complex partitioning scheme - missing physical volume

My personal systems run on: An open /boot partition separately random key encrypted /tmp and swap partitions and a password encrypted btrfs lvm volume holding everything else. My latest project is ...
0
votes
2answers
132 views

Automation and full-disk encryption

I know that the title seems to be completely contradictory, but allow me to elaborate. Reading Bruce Schneier's recent article on data deletion got me thinking that every server should have full-disk ...
1
vote
1answer
198 views

Possible to decrypt FDE/SED Samsung 840 upon boot without native BIOS/UEFI support for ATA password?

It's possible to encrypt and decrypt a drive with hdparm coupled with Full Disk Encryption like some Samsung and Intel SSDs. What I'm curious about is if it's possible to use with a Desktop ...
0
votes
0answers
202 views

Encrypting SVN Store with ecryptfs

I previously had TrueCrypt setup to automount my SVN repos on the Subversion server at boot with an automated network script that used a keyfile on a protected share to mount the volume. Now that ...
1
vote
1answer
134 views

Does filesystem encryption strain SSDs?

For security purposes we are required to implement full filesystem encryption on an upcoming server installation. We use the default encryption settings shipped with CentOS 7. My question: as our ...
2
votes
1answer
1k views

How can I encrypt 2008 Server Running under esxi

I have a need to run multiple 2008 R2 VMs under the free esxi. Storage will be local to the host. As I understand it, BitLocker is not a supported option in a VM environment from either Microsoft or ...
2
votes
2answers
108 views

Workstation imaging on top of full disk encryption

Is it possible to use imaging tools (e.g. Acronis Snap Deploy, or possibly SystemImager) to deploy workstation images to laptops that have PGP full disk encryption? How could I go about doing this? ...
2
votes
1answer
706 views

How to use Google Drive as secure storage on a linux server

since google dropped the price for storage recently I thought about using it at my storage servers too add storage capacity easily. What I found so far is the ability to mount the google drive into ...
3
votes
1answer
209 views

Enabling Disk Encryption on DC S 3700?

I have a server running Debian stable with two 100GB Intel DC S 3700 drives in a Linux MD RAID 1. According to Intel, these drives support 256-bit AES encryption and I would like to encrypt the data ...
0
votes
0answers
104 views

Trust relationship between workstation with PBA/Encryption and domain failed

I have installed some endpoint encryption solution on a laptop and from that point I could not login into the workstation with another user. Windows always tells me that the trust relationship between ...
2
votes
1answer
746 views

Changing Disk Encryption key in CentOS 6.4

I checked the "encryption" checkbox in the Anaconda installer during CentOS 6 installation, which encrypts at the PV (Physical Volume) partition level. Now, for some security reasons, I want to ...
1
vote
1answer
228 views

Expanding raid 5 luks partition

I have just bought 2 new drives to my raid 5 array. I have successfully added them to the array and resynced. I now have a /dev/md4 drive that is 16 TB, but the crypt-luks partition md4p1 is still 12 ...
0
votes
2answers
77 views

Mac Encryption and Reporting

We have a requirement at my company to support Macs. The machines need to be encrypted and have some sort of way to check in with a management system to verify the encryption status. This can be ...
1
vote
0answers
265 views

Can't mount ecrytpfs as a non-root user on Red Hat

I'm trying to mount a ecryptfs volume on Red Hat as a regular user. ecryptfs-utils is installed from source (repos only contain old versions). Mounting as root works normally, but trying with a ...
0
votes
2answers
62 views

Secure a live server

I've been asked to encrypt the filesystem of a live server without affecting the operations or data. I normally install Redhat with encrypted filesystem, so the "how" is not the problem. I want to ...
6
votes
1answer
1k views

BitLocker with Windows DPAPI Encryption Key Management

We have a need to enforce resting encryption on an iSCSI LUN that is accessible from within a Hyper-V virtual machine. We have implementing a working solution using BitLocker, using Windows Server ...
3
votes
1answer
345 views

Resting Encryption on iSCSI SAN in Hyper-V Environment

I have a need to implement resting encryption of data within our environment. Basically, we have a Hyper-V virtual server named FILER01 that runs Windows Server 2012 that is has a direct iSCSI ...
-5
votes
1answer
192 views

How to protect against in-RAM attacks

Since hosting providers are constantly under attack from hackers, encryption of the entire file system (the entire server) with tools like www.truecrypt.org seems like an absolute must to me, if you ...
5
votes
1answer
268 views

Determine if LUKS/dmcrypt key is present

I am writing a Chef LWRP to add a key to a LUKS container and I'm having difficulty coming up with a way to determine whether or not my key already exists. cryptsetup luksAddKey will happily add the ...
1
vote
1answer
897 views

Troubleshooting I/O latency possibly caused by file system driver

I have a SQL Server instance (SQL Server 2008 R2, Windows 2008 R2) that complains, for very short, random periods of about 15-20 seconds, that some of its I/O requests are taking longer than 15 ...
1
vote
1answer
119 views

Will adding a Windows machine to a different domain adversely affect DPAPI encryption?

I am considering moving a machine on which DPAPI encryption is used from one domain to another. Will doing this break or otherwise adversely affect the DPAPI configuration - and already encrypted ...
0
votes
1answer
483 views

Move an LXC container to a dm-crypt/LUKS filesystem

I need to move a container to a different filesystem, specifically a subdir of an already mounted LUKS/dm-crypt home dir. I tried moving it there and then bind mounting or symlinking it to ...
1
vote
1answer
860 views

CentOS 6.3 drive encryption being on remove server

During the clean installation of CentOS 6.3, I choose to encrypt the primary partition / (the whole drive) (obviously except /boot). My point is to have fully encrypted drive (8 drives in RAID10) but ...
2
votes
1answer
664 views

Possible to set encryption block size in LUKS?

When I do a benchmark test modprobe tcrypt sec=2 mode=200 I see that different encryption block sizes are used test 0 (128 bit key, 16 byte blocks): 4460604 operations in 2 seconds (71369664 ...
1
vote
1answer
734 views

Does cryptsetup “Plain mode” store the hashed passphrase in each sector?

When I read the manpage for cryptsetup on Linux about "Plain mode" it says: Plain dm-crypt encrypts the device sector-by-sector with a single, non-salted hash of the passphrase. and the -c ...
0
votes
1answer
719 views

How to re-encrypt disk with a different password (standard debian full disk encryption)?

I've got a situation where disk encryption password has been compromised and now am in a situation where I need to re-encrypt the hdd with a different password. It's a standard debian full disk ...