Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

In the company where I work, we're currently in the progress of setting up a new HR server. Right now, this server is in a seperate network, physically disconnected from the regular LAN, because this server contains sensitive data (wages, ...), that even those with network admin privileges shouldn't have access to.

So in order to incorporate this server with the rest of the LAN, we need to set up an encrypted disk which only those employed in HR have access to. Seems fairly straightforward at first, I quickly set up an encrypted partition with TrueCrypt, set an iSCSI target to it and tried to initiate that drive on a client machine. That's wehere the problems began.

Unfortunately, it seems TrueCrypt is not able to open multiple sessions to the same drive without problems occurring. I was able to initiate and mount the drive on several clients at once, but when I copied a file to it on one machine, it wouldn't appear on another (not even after dismounting/remounting) which is a big problem, since multiple users should be able to work on the encrypted drive simultaneously.

Is there any comparable software that would do the job as required? If not, do you have any suggestions for a practical workaround?

share|improve this question
Do you have the same problem if you share it as NAS, as described in truecrypt.org/docs/?s=sharing-over-network ? – ckhan Apr 24 '12 at 11:42
2  
The issue is the filesystem, not TrueCrypt. You can't share unencrypted drives over a network either. (You can share the files on them, which you can also do with TrueCrypt. But that won't help you.) – David Schwartz Apr 24 '12 at 11:57
@ckhan yeah, I read that, and it works as described in there. The problem is, when I mount the drive directly on the server, everyone who has access to the server will also be able to access that drive, which does not meet the requirements. It needs to be configured in such a way that the drive is only decrypted on the individual clients, but not accessible directly from the server without the password. – Axim Apr 24 '12 at 12:12
What are the OSes involved? If it was linux, it might be a simple matter of sshfs or some related filetype. – Journeyman Geek Apr 24 '12 at 12:27
Server and Clients are Windows based. There might be a possibility to run a Linux VM on the server if that might help, but the clients are going to be Windows no matter what. – Axim Apr 24 '12 at 12:31

2 Answers

up vote 2 down vote

I think you might consider the combination of BitLocker and EFS. BitLocker will encrypt the entire drive while EFS provides filesystem-level encryption.

share|improve this answer
Seems like this might be an acceptable solution. I've read that in domain networs, EFS will automatically set the domain admin as recovery-agent, thereby granting him access, which is undesired, but still seems like the best of all proposed solutions. – Axim Apr 24 '12 at 13:41
up vote 1 down vote

I suppose the question is where do you need this encrypted and what protocols can you use. You'd also want to add what oses are in play here.

You could probably throw together something with EFS (with certs for clients who're allowed to use them) and windows file sharing or 'webfolders' which is their implimentation of webdav - Microsoft has some suggestions here on the specifics

Serverfault has some questions relating to the same topic - AD and IPSEC is suggested here and ipsec, efs and bitlocker are brought up here.

If its linux, consider sshfs,sftp or scp shares. They can be mounted pretty easily and provide end to end encryption.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.