The tag has no usage guidance.

learn more… | top users | synonyms

37
votes
12answers
9k views

What do you do about staff and personal laptops?

Today, one of our developers had his laptop stolen from his house. Apparently, he had a full svn checkout of the company's source code, as well as a full copy of the SQL database. This is one ...
7
votes
2answers
185 views

LUKS Error During Boot

I only see this error on the console during the boot process of virtual machines we create. EDIT: 2/5/16 - I see it on some bare-metal installations, too. (It does proceed to boot completely.) I ...
7
votes
2answers
2k views

Approaches for Linux server disk encryption

What are the approaches available for fully encrypting a disk on a remote server (say, colocated in a datacenter)? On Windows, we can just turn on Bitlocker with a TPM. Then the server can reboot, and ...
7
votes
1answer
449 views

State of hardware-assisted disk encryption in Linux

I use dm-crypt to encrypt partitions. I am building a small office server from consumer (or pro-sumer) category hardware. It made me wonder, hardware-assisted encryption is a notion in the air for ...
6
votes
8answers
2k views

Recommended drive encryption solution

I will soon be purchasing a number of laptops running Windows 7 for our mobile staff. Due to the nature of our business I will need drive encryption. Windows BitLocker seems the obvious choice, but it ...
6
votes
1answer
331 views

Does LUKS also encrypt free space?

I have moved to Ubuntu 12 and chosen to use full disk encryption (encrypted LVM). So now I'm wondering: should I shred (eg: with secure-delete package, srm) the free disk space to remove any remnant ...
6
votes
1answer
1k views

BitLocker with Windows DPAPI Encryption Key Management

We have a need to enforce resting encryption on an iSCSI LUN that is accessible from within a Hyper-V virtual machine. We have implementing a working solution using BitLocker, using Windows Server ...
5
votes
7answers
11k views

Windows XP Full Disk Encryption - What are the options?

I've been ask to look at full disk encryption software for our mobile users. We're running Windows XP SP3 PCs on a domain and my understanding is that we will not be upgrading to Vista and have no ...
5
votes
3answers
3k views

When to use Truecrypt, and when not to?

I have about 30 (this number will most likely grow over the next few years to 50 or more) unencrypted laptops that I have been tasked to encrypt (entire drive). These machines will be used off site ...
5
votes
1answer
280 views

Determine if LUKS/dmcrypt key is present

I am writing a Chef LWRP to add a key to a LUKS container and I'm having difficulty coming up with a way to determine whether or not my key already exists. cryptsetup luksAddKey will happily add the ...
4
votes
2answers
2k views

Encrypt remote linux server

One of my customers has requested that their web server is encrypted to prevent offline attacks to highly sensitive data contained in a mysql database and also /var/log. I have full root access to the ...
4
votes
1answer
2k views

Very slow write performance on Debian 6.0 (AMD64) with DMCRYPT/LVM/RAID1

I'm seeing very strange performance characteristics on one of my servers. This server is running a simple two-disk software-RAID1 setup with LVM spanning /dev/md0. One of the logical volumes /dev/vg0/...
3
votes
1answer
137 views

Why make random file for loopback device for encrypted file system?

I have read a few tutorials on setting up an encrypted file system using cryptsetup. They all start with the following creation of a random file dd if=/dev/urandom of=/etc/cryptfile bs=1M count=10 ...
3
votes
1answer
355 views

Resting Encryption on iSCSI SAN in Hyper-V Environment

I have a need to implement resting encryption of data within our environment. Basically, we have a Hyper-V virtual server named FILER01 that runs Windows Server 2012 that is has a direct iSCSI ...
3
votes
1answer
597 views

Are there any Microsoft Exchange Clients for iOS and Android that store their local data in an encrypted manner?

I don't feel like this is a product recommendation question, more of a "does this tech even exist and is it feasible" question, but if I'm wrong, feel free to give this question the boot. Context: ...
3
votes
1answer
429 views

Cryptsetup luks - Check that kernel supports aes-xts-plain64 cipher

I encrypted a bunch of hard drives with cryptsetup luks encryption on CentOS 5. Everything was fine, until I upgraded my system to CentOS 6. Now I cannot mount the disks anymore. To mount with my ...
3
votes
3answers
3k views

Full disk encryption on linux (ubuntu) w/o re-installing - possible?

I work at a company that takes security very seriously (like most). Our IT guy came in today to prepare us mentally to re-install our systems after he'll apply the new encryption policy (which will ...
3
votes
2answers
182 views

eCryptfs headers errors

I'm getting the following error on a server where a partition is encrypted thru ecryptfs. [3440851.003561] Valid eCryptfs headers not found in file header region or xattr region, inode 22545087 [...
3
votes
0answers
54 views

Can servers with encrypted root filesystems be made reasonably highly available?

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
3
votes
0answers
34 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
3
votes
1answer
218 views

Enabling Disk Encryption on DC S 3700?

I have a server running Debian stable with two 100GB Intel DC S 3700 drives in a Linux MD RAID 1. According to Intel, these drives support 256-bit AES encryption and I would like to encrypt the data ...
2
votes
2answers
1k views

OS reinstall on a machine with Whole Disk Encryption

I have a machine that has McAfee SafeBoot Whole Disk Encryption on it. If I don't have the safeboot password, can I boot from a OS installation disk, format the disk and reinstall the OS? Will that ...
2
votes
1answer
3k views

What cipher is the “best” or better for LUKS?

I am looking for strong cipher for LUKS, currently I am thinking about SHA512, but encryption is not my cup of tea, so could you give me your hints, what are you using for encryption?
2
votes
2answers
2k views

Security of BitLocker with no PIN from WinPE?

Say you have a computer with the system drive encrypted by BitLocker and you're not using a PIN so the computer will boot up unattended. What happens if an attacker boots the system up into the ...
2
votes
1answer
1k views

How can I encrypt 2008 Server Running under esxi

I have a need to run multiple 2008 R2 VMs under the free esxi. Storage will be local to the host. As I understand it, BitLocker is not a supported option in a VM environment from either Microsoft or ...
2
votes
1answer
790 views

Changing Disk Encryption key in CentOS 6.4

I checked the "encryption" checkbox in the Anaconda installer during CentOS 6 installation, which encrypts at the PV (Physical Volume) partition level. Now, for some security reasons, I want to ...
2
votes
1answer
150 views

Replacing a Self encrypting Hard Drive in an IBM xseries server raid

I have a failed drive in a RAID 5 array in an IBM x3650, Machine Type 7945. The RAID is composed entirely of original IBM SED SAS drives, 300GB ea. Unfortunately I am the purchasing Tech, not the ...
2
votes
1answer
1k views

How to send “ATA Secure Erase” command to SSD?

A very good way to erase a SSD which have SED support is to change the password/key. But what to do with those that doesn't have SED support? This article says Fortunately it is possible to erase ...
2
votes
1answer
788 views

How can I input password to manage-bde -pw option via windows powershell

I am trying to encrypt Data volume (for example E:) with the following command: manage-bde -protectors -add E: -pw When I execute the above command, it will ask for the password, so I entered it. ...
2
votes
1answer
709 views

Possible to set encryption block size in LUKS?

When I do a benchmark test modprobe tcrypt sec=2 mode=200 I see that different encryption block sizes are used test 0 (128 bit key, 16 byte blocks): 4460604 operations in 2 seconds (71369664 bytes)...
2
votes
2answers
442 views

Decrease in disk performance after partitioning and encryption, is this much of a drop normal?

I have a server that I only have remote access to. Earlier in the week I repartitioned the 2 disk raid as follows: Filesystem Size Used Avail Use% Mounted on /dev/mapper/sda1_crypt ...
2
votes
2answers
348 views

Does dm-crypt support journaling filesystem transactional guarantees?

I'm considering using ext4 on encrypted LVM (which uses LUKS and dm-crypt). Will the transactional guarantees in ext4's journaling be preserved? Bonus: where may I find authoritative information ...
2
votes
2answers
1k views

Variable size encrypted container [closed]

Is there an application similar to TrueCrypt, but the one that can make variable size containers opposed to fixed-size or only-growing-to-certain-amount containers which can be made by TrueCrypt? I ...
2
votes
1answer
448 views

Apache serving files from an encrypted drive returns a 403 forbidden error

I create a sparsebundle and mount it as a virtual drive for each development project I work on. This works great until I needed to add encryption to one of the projects for added security of my client'...
2
votes
2answers
1k views

Clarifications on encrypted LVM in Ubuntu, RAID1, and headless server

I’ve pondered about encrypting my hard disk on my laptop and server for quite some time, but never got around to it since I don’t think I understand how encryption affects my day to day usage and the ...
2
votes
2answers
4k views

CentOS / Redhat 6 Mount Encrypted Partition After Boot

I have an encrypted partition that I setup during install for CentOS 6 that I want to mount manually after boot. By default it prompts me for a password at boot time. I was able to get it to not ...
2
votes
2answers
253 views

Looking for centrally managed full-disk encryption product for Windows 7

Let me start this off by saying I've already evaluated and have planned to purchase SecureDoc Enterprise from WinMagic. However, due to billing issues (not price) I'm afraid I may not be able to make ...
2
votes
1answer
393 views

Migrating xp laptops with encryption to Windows 7

We are starting to look at migrating our systems to Windows 7 from XP. I've been playing with MDT 2010 doing automated installs and using USMT. I haven't started looking at how migrating xp laptops ...
2
votes
2answers
112 views

Workstation imaging on top of full disk encryption

Is it possible to use imaging tools (e.g. Acronis Snap Deploy, or possibly SystemImager) to deploy workstation images to laptops that have PGP full disk encryption? How could I go about doing this? ...
2
votes
1answer
728 views

How to use Google Drive as secure storage on a linux server

since google dropped the price for storage recently I thought about using it at my storage servers too add storage capacity easily. What I found so far is the ability to mount the google drive into ...
2
votes
2answers
2k views

Data encryption on VPS

I know there is no way to completely secure a running system, however I'd like to do do what ever is possible. I'm not sure how to phrase the question, but basically, I'd like to secure the data on ...
1
vote
6answers
7k views

Mounting encrypted drive/partition on Linux

I have a Laptop, on which the OS has got corrupted and gives a system32\config not found error. To recover my data, I can boot it using Knoppix but I am not able to mount my partition. My partition ...
1
vote
2answers
192 views

LUKS/dm-crypt security in the case of a break-in

This is an encryption topic I've been confused by for a while now. From what I understand of LUKS, once the LUKS volume is opened with a passphrase and the resulting device mapper device is mounted, ...
1
vote
1answer
2k views

ESXi encypted VMFS?

Does anyone know a (free?) way to have a fully encrypted local-disk (no NFS,iSCSI,FC) VMFS inside the hypervisor itself? I am using ESXi 4.1 U2.
1
vote
1answer
2k views

Disable asking for a passphrase without having to re-make the encrypted partition

I have a server which I set up with its root partition totally encrypted. I urgently need to disable the passphrase dialog at startup because it is not letting the server boot up after an electricity ...
1
vote
1answer
3k views

Can I encrypt a single folder in Windows Server 2008 R2 with BitLocker?

Using Windows Server 2008 R2, is there a way to encrypt a folder, not the whole disk using Bitlocker?
1
vote
1answer
212 views

Possible to decrypt FDE/SED Samsung 840 upon boot without native BIOS/UEFI support for ATA password?

It's possible to encrypt and decrypt a drive with hdparm coupled with Full Disk Encryption like some Samsung and Intel SSDs. What I'm curious about is if it's possible to use with a Desktop ...
1
vote
1answer
758 views

Does cryptsetup “Plain mode” store the hashed passphrase in each sector?

When I read the manpage for cryptsetup on Linux about "Plain mode" it says: Plain dm-crypt encrypts the device sector-by-sector with a single, non-salted hash of the passphrase. and the -c ...
1
vote
1answer
252 views

some Zimbra project planning questions

I am planning to deploy a ZCS machine in a remote DC on colocation. Using the latest Community edition Hardware: 2x SAS disks for OS in raid1, 8x SAS disks in raid10 for Zimbra, 32Gb RAM 8 CPU ...
1
vote
1answer
28 views

Encrypted root partition not booting properly

I have a Debian 8 VPS with an encrypted root partition. After a kernel update a few months ago (package version 3.2.73-2+deb7u3), it stopped being able to decrypt properly on boot. As far as I can ...