Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We want to encrypt a folder using GPG, but we want to prevent a disgruntled employee from changing the private key, encrypting the folder, and then leave the company. I know you can revoke a key pair, but that's only if you know before hand that the employee is leaving.

Or is there a way to encrypt a folder with a specific public/private key pair only.


share|improve this question
I think to get an answer, you should provide more information like who owns the folder, who should have access to it, whom should the keys belong to, etc... – Felix Jan 5 '10 at 14:10
Only a certain group should have access to the files. We would encrypt the entire folder, and preferably have a way to decrypt the data if a user encrypts with a different key. – mike Jan 8 '10 at 23:13
I think the only way around this is to keep daily/hourly backups of the encrypted folder. Ultimately, it's the same risk as having a rogue user delete the folder. – Iain Jan 9 '10 at 8:02
You are right. I'll recommend that and see how it goes. Thanks for your help! – mike Jan 9 '10 at 20:29
What platform is this? – 0xC0000022L May 24 '12 at 14:24
up vote 2 down vote accepted

Your problem is not an encryption problem. It's a trust issue.

If you fear a certain employee might potentially harm your company's data, then that user can not be allowed write access to that data.

This applies primarily to unique data. If these are just working copies of your master data, then there is no real issue.

share|improve this answer

If you want multiple keys to be used to encrypt the data, you could use LUKS volume on linux, they accept multiple "pass". Each pass can be a password or a file. Each employee would have a "pass", would it be a file signed by his PGP key, or whatever (the PGP ensure it would have been generated by himself). The admin adds that file as a LUKS key (with cryptsetup luksAddKey /dev/mapper/decryptedVolume /path/to/passFile ) and when the person leaves, you revoke that pass (with cryptsetup luksDelKey <keySlot>)

share|improve this answer

I can't find any information about how to encrypt folders with GPG.

Assuming you are not yet committed to GPG, Truecrypt is an excellent open-source folder and drive encryption program which deals with this problem.

The Truecrypt FAQ describes how to reset passwords if reset by non-administrators. See the question:

We use TrueCrypt in a corporate/enterprise environment. Is there a way for an administrator to reset a volume password or pre-boot authentication password when a user forgets it (or loses a keyfile)?

share|improve this answer
Truecrypt may work, but I thought there would be something more like having two private keys for the same encrypted data. – mike Jan 8 '10 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .