Tag Info

Hot answers tagged

9

When you format a drive you don't erase any of the data that on it. You only overwrite the part that keeps track of where files are (the filesystem). The only way to get rid of the data is to overwrite it. If you overwrite it with zeros as Azz suggests, an attacker will know which parts are information and which parts are zeroes instantly. Random data looks ...


7

I know of a clever variant of Option 1 called Mandos. It uses a combination of a GPG key pair, Avahi, SSL and IPv6 all added to your initial RAM disk to securely retrieve its root partition's key password. If the Mandos server isn't present on the LAN your server is an encrypted brick or the Mandos server hasn't seen a heartbeat from the Mandos client ...


7

Your first problem is you have an administrator that you don't trust. This is a human resources issue, and you may need to take it up as such. Second, you could only "protect" them by placing the files in a volume that's encrypted separate from Windows (encapsulating the data). There are methods to do this and products to do so if you google for it. BUT ...


6

Yes and no. Not directly - the data can only be decrypted with the user's password, which root doesn't have. But a malicious root user can always get around that kind of thing - they own the system. A couple of workable options come to mind, but I'm sure there are plenty of others: pulling the decrypted private key from memory while the user's logged in, ...


6

If you're just looking to protect against non-technical attackers I think your best bet is better physical security. My thinking is thus: If you're looking for a boot requiring no human interaction to enter key material then you're not going to come up with any solution that will be safe from even casual theft by an attacher with any technical skills (or, ...


5

In addition to capturing the user's password when they log in, root can also access the encrypted filesystem while it's mounted (i.e. when you're logged in), by sudoing to your user.


5

No. EFS encryption doesn't occur at the application level but rather at the file-system level; therefore, the encryption and decryption process is transparent to the user and to the application. If a folder is marked for encryption, every file created in or moved to the folder will be encrypted. Applications don't have to understand EFS or manage ...


4

You must export the EFS private key from the first machine using certmgr.msc and import it to the second machine. Only then you will be able to decrypt files. (Passwords and anything else do not matter.) But having two EFS private keys on one machine can really confuse both the user and the OS... A better solution would be to use full-drive encryption ...


3

It is possible to give multiple users access to an EFS encrypted file, so long as you are using windows XP or above on clients, and server 2003 or above on the server. You cannot do it for a group, you will need to add each individual user. The main point to be aware of with this is that the user(s) you want to give access to the EFS encrypted file must ...


3

I'm reasonably certain that Samba4 does not support hosting the Encrypting File System. None of the changelogs since Samba 3.0 mention it as a feature, and the Samba 3 page itself shows it as a feature they'd like to have since Microsoft released details about how it works; which is different than a feature they actually have.


3

After setting up a test VM environment, I determined the following. To view EFS encrypted files, YOUR personal EFS store must contain the PRIVATE key of the certificate created by the user who encrypted the file, OR the private key of the Recovery Agent certificate. You cannot import the private key into the machine's certificate store as this only gives ...


3

BitLocker only protects data at rest. EFS only uses public/private key encryption - certificates. The certificates may be self-signed and created automatically by Windows (sub-optimal), or you can have your AD CA auto-enroll users for EFS certificates (preferred). CA-issued certificates may be required, unless your usage scenario is very simple. ...


2

First of all, let me point out that EFS relies on certificates for encryption, so replicating or backing up the files is useless without backing up the certificate(s) used to generate those files as well. (So, if you're not already doing so, do so.) This is presumably a large part of the reason that Microsoft's replication technologies don't support EFS. ...


2

Nothing would prevent the admin to install keyloggers etc., and you wouldn't even notice, so: No, your assumptions are wrong.


2

With some sort of KVM over IP or a serial console.


2

tl:dr: No If you want the key to be used automatically on boot then the key must be accessible on boot. Which means on the unencrypted part of the disk. If it is on the unencrypted part of the disk then other can take the disk out of your system, read the key and decrypt the rest of the disk. There is no way to properly protect the disk and not to store ...


2

At first I thought that you would want to create a Domain Recovery Agent. Then I was reminded that, (and I cannot confirm this), I believe that a DRA is only good for recovering encrypted files that were encrypted after the agent was created. Also, revoking the certificate might complicate matters some. Nonetheless, consider what you can do with the Domain ...


2

Are you sure that the service account your using for SQL Server matches the user account your using to encrypt the files? EFS is handled at the OS and is transparent to SQL Server. If this is the case, then check for general NTFS permissions, make sure that the service account has full control of the files your trying to attach. May be stating the ...


2

Check the NTFS permissions (as Nick said) and ensure that the SQL Server has access to the files using the account that the service is running under, as well as the account you are using to connect to the SQL Server. When you detach a database the SQL Server automatically removes the rights to the files from everyone except the person who detached the ...


2

1) There is a performance hit. That might be low enough for you to handle... or maybe not. You'll have to test in your environment. 2) FS crashes aren't any worse with encryption, though when booting into whatever recovery console you use (main system , or a boot cd) you'll need to have all the encryption tools and pass phases or keys to unlock the ...


2

I'd setup File Monitor with a suitable filter and leave it running. Or have it triggered by Performance Monitor. Certainly leave Perfmon running to see the time as this might give an indication of a cronjob running at the same time etc..


1

Sounds like file system corruption; run chksdk and see what it reports. EFS should not prevent you from deleting files, just reading them.


1

Chkdsk showing anything? Executing a delete command from cmd.com shell doesn't do anything either? What about mounting the share from a Linux system and then sudo rm filename from that? still fail? I'd be really tempted if the filesystem check isn't fixing it to try booting with a Linux liveCD and mounting the NTFS drive and trying to delete the file from ...


1

I think using public key cryptography would be a good fit for this. Generate the secret, then encrypt it with the public key. Save it locally. Share it everywhere for all anyone cares. Provided your initial encryption is good enough, there is no issue with local administrators having access to the encrypted secret. This assumes of course you do not ...


1

Have you tried to unencrypt these files? You can also use the efsinfo command from the Resource kit to get more information about the files. Cipher /d /a Efs###.tmp


1

Like with your house or car, the only way to keep your data secure is to not leave your keys laying around... This kind of precludes automatic boot, unless you were to do something like seriously secure a key server, say by building it into a wall or pouring it into the foundation? :-) I, personally, have done two different things in this situation. One ...


1

If you setup recover agents in group policy, you should be able to install the recovery agent's private key onto the new machine and decrypt the files when logged in as that user. Also another option would be to see if you can export the users private key from the CA or if it has already been exported somewhere else and install this key for the user. If ...


1

Depending on the reliability of your password (how secure it is), it should be effectively unbreakable. It uses high grade encryption from everything I could find. Note that storing the password on the system you are running encfs on will make it useless. That is, if you store the password in a file on the system itself, it won't take long for an attacker ...


1

The dell dimension A07 bios does support legacy usb iirc. I think the problem might be windows, rather than anything else: I've had this problem a couple of times on Dell boxes running windows XP. 1) install windows XP and everything is happy. 2) shut down the box, change usb keyboard/mouse, switch back on. 3) Computer refuses to see the keyboard and ...


1

My understanding is that without a backup this is impossible by design. http://www.cgsecurity.org/wiki/Recover_a_TrueCrypt_Volume



Only top voted, non community-wiki answers of a minimum length are eligible