I get requests from customers where they have an application dump files into the FS on linux and want those files to be automatically encrypted. Not in the sense of an enrypted FS, but in a way that no one, even root, can read these files. The data is also stored in an encrypted database (I know, that will also require some sort of "secure" key storage - but this is assumed to be safe. I know this is probably not true - but nothing I can change). For debugging purposes the data is also stored as plain files - and these must be secured as they contain sensitive data.

As far as my understanding goes, this is not really possible. A daemon watching the FS could pick up unencrypted files and encrypt them with a public key, where the private counter part is stored in a password vault. Of course, no automatic reading would be possible, but that would be ok. However, there will be a short moment where files are unencrypted.

Does anyone know a good solution for this problem? My take is that the application should take care of the encryption, but wanted to make sure I did not miss anything.

The application is custom made, so yes, it can be altered.

  • What is the goal of your customer here? – ceejayoz Mar 1 '16 at 15:44
  • and can the application be modified? If so, just have it use GPG to encrypt for a public key of your choice. – ceejayoz Mar 1 '16 at 15:45
  • The application user can use something like EncFS but that can still be bypassed by root if not very easily and that argument holds basically true for anything that isn't handled by the application itself. – HBruijn Mar 1 '16 at 16:11

If you're not allowed to have unencrypted data on FS for even 1 seconds, you need to save already encrypted data. You will encrypt data in application (with some hardcoded, compiled in key) and storing those already encrypted data.

  • But don't forget there are data stored unencrypted in memory.... – Ondra Sniper Flidr Mar 2 '16 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.