2

I need to encrypt a 3.5TB folder on 2008 R2 server. The folder is shared and both users and applications need to access the files(pdf) in it over the network. Since the server is a VM (ESXi 5) Bitlocker is not supported. EFS with AD CS managed keys should work.
I'm looking for input in form of a good implementation guide and actual user/admin experiences, if there is anyone actually using it.
How bad of the performance degradation would I see?(Xeon R7-4850) If there is a better solution for encrypting network shares please let me know.

1 Answer 1

1

Well I can't quantify exactly how much of a performance impact you would feel. There would be some. But the point is, if you're required to encrypt this data then that is what you have to do, and you just have to bite the bullet on any potential performance impact.

Have you considered that, once a client accesses an EFS-encrypted file on an SMB network share, that the file is decrypted on the server and then transmitted un-encrypted/"cleartext" over the network?

First, I would consider migrating this traditional file share to something like WebDAV, as that will allow you to transfer the data over an SSL/TLS/HTTPS protected channel across the network.

Some relevant words from Microsoft:

Remote EFS Operations on File Shares and Web Folders

Users can encrypt and decrypt files that are stored on network file shares or on Web Distributed Authoring and Versioning (WebDAV) Web folders. Web folders have many advantages compared to file shares, and Microsoft recommends the use of Web folders whenever possible for remote storage of encrypted files. Web folders require less administrative effort and are more secure than file shares. Web folders can also securely store and deliver encrypted files over the Internet by using standard HTTP file transfers. Using file shares for remote EFS operations requires a Windows 2000 or later domain environment because EFS must impersonate the user by using Kerberos delegation to encrypt or decrypt files for the user.

The primary difference between remote EFS operations on files stored on file shares and files stored on Web folders is where the operations occur. When files are stored on file shares, all EFS operations occur on the computer on which the files are stored. For example, if a user connects to a network file share and chooses to open a file that he or she previously encrypted, the file is decrypted on the computer on which the file is stored and then transmitted in plaintext over the network to the user’s computer. When files are stored on Web folders, all EFS operations occur on the user’s local computer. For example, if a user connects to a Web folder and chooses to open a file that he or she previously encrypted, the file remains encrypted during transmission to the user’s computer and is decrypted by EFS on the user’s computer. This difference in where EFS operations occur also explains why file shares require more administrative configuration than Web folders.

Oh, and there's also SMB encryption but it is new to Server 2012 and SMB 3.0. You have indicated that you're using 2008R2 however.

http://blogs.msdn.com/b/openspecification/archive/2012/10/05/encryption-in-smb-3-0-a-protocol-perspective.aspx

4
  • I will look into 2012 SMB encryption. If it's easier/better/faster I can definitely install some 2012 Servers. Nov 24, 2013 at 17:52
  • Yep. And there are other solutions too, such as IPsec, but I didn't mention it at first because that is a much larger undertaking with a bigger scope. Basically my point is that when considering data encryption, there are two separate aspects to keep in mind - data at rest, and data in transit over the network. Gotta' remember to protect them both.
    – Ryan Ries
    Nov 24, 2013 at 17:54
  • Over the wire encryption is not a problem at this point as both the file server and Citrix servers are in a secure data center. I think webdav is also much slower than file shares. Nov 24, 2013 at 17:55
  • Looks like for SMB 3 both the server and client has to 2012. Not ready for that yet. Nov 24, 2013 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .