Tag Info

Hot answers tagged

9

When you format a drive you don't erase any of the data that on it. You only overwrite the part that keeps track of where files are (the filesystem). The only way to get rid of the data is to overwrite it. If you overwrite it with zeros as Azz suggests, an attacker will know which parts are information and which parts are zeroes instantly. Random data looks ...


6

If you're just looking to protect against non-technical attackers I think your best bet is better physical security. My thinking is thus: If you're looking for a boot requiring no human interaction to enter key material then you're not going to come up with any solution that will be safe from even casual theft by an attacher with any technical skills (or, ...


6

I know of a clever variant of Option 1 called Mandos. It uses a combination of a GPG key pair, Avahi, SSL and IPv6 all added to your initial RAM disk to securely retrieve its root partition's key password. If the Mandos server isn't present on the LAN your server is an encrypted brick or the Mandos server hasn't seen a heartbeat from the Mandos client ...


6

Yes and no. Not directly - the data can only be decrypted with the user's password, which root doesn't have. But a malicious root user can always get around that kind of thing - they own the system. A couple of workable options come to mind, but I'm sure there are plenty of others: pulling the decrypted private key from memory while the user's logged in, ...


5

No. EFS encryption doesn't occur at the application level but rather at the file-system level; therefore, the encryption and decryption process is transparent to the user and to the application. If a folder is marked for encryption, every file created in or moved to the folder will be encrypted. Applications don't have to understand EFS or manage ...


4

You must export the EFS private key from the first machine using certmgr.msc and import it to the second machine. Only then you will be able to decrypt files. (Passwords and anything else do not matter.) But having two EFS private keys on one machine can really confuse both the user and the OS... A better solution would be to use full-drive encryption ...


2

1) There is a performance hit. That might be low enough for you to handle... or maybe not. You'll have to test in your environment. 2) FS crashes aren't any worse with encryption, though when booting into whatever recovery console you use (main system , or a boot cd) you'll need to have all the encryption tools and pass phases or keys to unlock the ...


2

Are you sure that the service account your using for SQL Server matches the user account your using to encrypt the files? EFS is handled at the OS and is transparent to SQL Server. If this is the case, then check for general NTFS permissions, make sure that the service account has full control of the files your trying to attach. May be stating the ...


2

Check the NTFS permissions (as Nick said) and ensure that the SQL Server has access to the files using the account that the service is running under, as well as the account you are using to connect to the SQL Server. When you detach a database the SQL Server automatically removes the rights to the files from everyone except the person who detached the ...


1

Depending on the reliability of your password (how secure it is), it should be effectively unbreakable. It uses high grade encryption from everything I could find. Note that storing the password on the system you are running encfs on will make it useless. That is, if you store the password in a file on the system itself, it won't take long for an attacker ...


1

Like with your house or car, the only way to keep your data secure is to not leave your keys laying around... This kind of precludes automatic boot, unless you were to do something like seriously secure a key server, say by building it into a wall or pouring it into the foundation? :-) I, personally, have done two different things in this situation. One ...


1

I found an acceptable alternate solution with Symantec PGP File Share Encryption. With this, you can select various network path and specify that files in that folder should be encrypted and you can give various PGP keys. When you put files there, they get encrypted. When you pull files out of there, they are decrypted.


1

tl:dr: No If you want the key to be used automatically on boot then the key must be accessible on boot. Which means on the unencrypted part of the disk. If it is on the unencrypted part of the disk then other can take the disk out of your system, read the key and decrypt the rest of the disk. There is no way to properly protect the disk and not to store ...


1

No. If you wish to decrypt it automatically, you need to have your password stored on the disk in cleartext, or obscured in some (bad) way. Someone with enough willpower will be ably to get that password easily. If only "/boot" is unencrypted, the password has to be there, and the attacker just has to find it. If you just don't wish to be physically ...



Only top voted, non community-wiki answers of a minimum length are eligible