7

Your first problem is you have an administrator that you don't trust. This is a human resources issue, and you may need to take it up as such. Second, you could only "protect" them by placing the files in a volume that's encrypted separate from Windows (encapsulating the data). There are methods to do this and products to do so if you google for it. BUT ...


7

Yes and no. Not directly - the data can only be decrypted with the user's password, which root doesn't have. But a malicious root user can always get around that kind of thing - they own the system. A couple of workable options come to mind, but I'm sure there are plenty of others: pulling the decrypted private key from memory while the user's logged in, ...


7

Actually, I think S3 Sync is what you want. Maybe setup Cron on the EC2 instances and invoke S3 Sync that way? Are you using ECS as well? I have a Cron container that does the job pretty well. For those reading who are not familiar with AWS CLI (https://aws.amazon.com/cli/) the syntax for S3 Sync is like: aws s3 sync /path/to/source/ s3://bucket/...


5

In addition to capturing the user's password when they log in, root can also access the encrypted filesystem while it's mounted (i.e. when you're logged in), by sudoing to your user.


5

BitLocker only protects data at rest. EFS only uses public/private key encryption - certificates. The certificates may be self-signed and created automatically by Windows (sub-optimal), or you can have your AD CA auto-enroll users for EFS certificates (preferred). CA-issued certificates may be required, unless your usage scenario is very simple. ...


5

No. EFS encryption doesn't occur at the application level but rather at the file-system level; therefore, the encryption and decryption process is transparent to the user and to the application. If a folder is marked for encryption, every file created in or moved to the folder will be encrypted. Applications don't have to understand EFS or manage EFS-...


4

After setting up a test VM environment, I determined the following. To view EFS encrypted files, YOUR personal EFS store must contain the PRIVATE key of the certificate created by the user who encrypted the file, OR the private key of the Recovery Agent certificate. You cannot import the private key into the machine's certificate store as this only gives ...


3

I'm reasonably certain that Samba4 does not support hosting the Encrypting File System. None of the changelogs since Samba 3.0 mention it as a feature, and the Samba 3 page itself shows it as a feature they'd like to have since Microsoft released details about how it works; which is different than a feature they actually have.


2

Nothing would prevent the admin to install keyloggers etc., and you wouldn't even notice, so: No, your assumptions are wrong.


2

At first I thought that you would want to create a Domain Recovery Agent. Then I was reminded that, (and I cannot confirm this), I believe that a DRA is only good for recovering encrypted files that were encrypted after the agent was created. Also, revoking the certificate might complicate matters some. Nonetheless, consider what you can do with the Domain ...


2

tl:dr: No If you want the key to be used automatically on boot then the key must be accessible on boot. Which means on the unencrypted part of the disk. If it is on the unencrypted part of the disk then other can take the disk out of your system, read the key and decrypt the rest of the disk. There is no way to properly protect the disk and not to store ...


2

With some sort of KVM over IP or a serial console.


2

First of all, let me point out that EFS relies on certificates for encryption, so replicating or backing up the files is useless without backing up the certificate(s) used to generate those files as well. (So, if you're not already doing so, do so.) This is presumably a large part of the reason that Microsoft's replication technologies don't support EFS. (...


2

I can't believe this answer has been up-voted, with out anyone correcting it. YES. EFS on Server 2008 R2 supports multiple users accessing an encrypted file. http://windowsitpro.com/security/efs-and-encrypted-file-sharing


2

I didn't know the answer to this, but it looked interesting so I'd thought I'd try and replicate the problem. With a default install of 2012 R2 (didn't have 2008 R2 to hand) I got the same error when trying to copy an EFS encrypted file from one domain joined machine to a share on another. Google eventually lead me to this article; http://technet....


2

Back up EFS using a tool such as Attic to create a compressed, incremental, de-duplicated backup on one EC2 instance. Use S3FS or the S3 API to upload those files to S3. Personally I use a dropbox upload script, which works fine as well. Note that Attic runs at whatever interval you specify, but keeps only the checkpoints you specify. For example you might ...


2

Your question should probably be broken up into multiple questions, so I'm not going to go into great detail. "I would like to prevent users from copying a file to a USB flash drive and taking it home or cloning a hard disk or just removing the hard disk from a work station." You could lock the workstation cases to keep people from removing the hard ...


2

If you use an encrypted file system, one needs a password to unlock the contents of the hard drive when mounting the file system. Without the password, the files cannot be accessed. However, if the file system is already mounted (accessible), then all files can be used normally. In order to encrypt a single file (your backup), you need to use software like ...


2

Swap files cannot be sparse files. They must be fully allocated. If the system tries to write to a part of a swap file that wasn't allocated, the write error occurs. Copying the swap file fixes the problem by fully allocating the destination file. You can fix the original problem by creating a fully allocated swap file to begin with. There are a few ways ...


1

You can add a user/key to a single encrypted file only, not on a entire directory. This depend on how EFS works. So, the "add" button will be present only when editing single file properties.


1

For d-i partman-auto/method string crypto, you need to put a space character between in_vg and { (braces) like so: in_vg{ vg_crypto_tmp } -> in_vg { vg_crypto_tmp }


1

I used the following recipe with great success to automate creation of encrypted partitions on many user systems. This recipe assumes /dev/sda as the volume to use and uses xfs as the default filesystem (my preferred filesystem). In addition it uses a simplified partitioning scheme of a small /boot, ~50 GB of /, ~200% of RAM as swap (probably limit it to 64 ...


1

It is not possible via built-in mechanisms. A bit of theory: private key strong protection prompts for input only when private key material is accessed. A bit of practice: when you encrypt/decrypt files on remote share, remote certificate is used to perform these operations. That is, EFS loads user profile on a file share hosting server, loads the ...


1

The point of EFS is that decryption must be deliberate. If you try and copy an EFS encrypted file to a different computer that doesn't support EFS, then you will get a warning. Ideally, this is a training issue. Teach your users how to decrypt their files.


1

I found an acceptable alternate solution with Symantec PGP File Share Encryption. With this, you can select various network path and specify that files in that folder should be encrypted and you can give various PGP keys. When you put files there, they get encrypted. When you pull files out of there, they are decrypted.


1

Well I can't quantify exactly how much of a performance impact you would feel. There would be some. But the point is, if you're required to encrypt this data then that is what you have to do, and you just have to bite the bullet on any potential performance impact. Have you considered that, once a client accesses an EFS-encrypted file on an SMB network ...


1

According to Microsoft Support, this is a bug. When using Windows Encrypted File System with modern Office documents and multiple users (certificates) the additional user-certificates are lost after the file has been edited. The problem still exists on Windows 8 with Office 2013 It may be a conceptual problem and I don't know whether it will or can be ...


1

No. If you wish to decrypt it automatically, you need to have your password stored on the disk in cleartext, or obscured in some (bad) way. Someone with enough willpower will be ably to get that password easily. If only "/boot" is unencrypted, the password has to be there, and the attacker just has to find it. If you just don't wish to be physically ...


1

An "untrusted" administrator should be getting his rights revoked. There are tons of other ways to steal data if you have full rights on a server.


1

I'm not exactly sure what is preventing the the DRA from being set on the file, but here is a breakdown of the EFS GPOs I have which may help you verify all the components are in place. Getting EFS set up is a pretty complex patchwork of components if you ask me. Computer GPO for Recovery Policy. It sounds like you have this setup correctly with the ...


Only top voted, non community-wiki answers of a minimum length are eligible