0

i would like to provide a dedicated space on a network drive where files can be encrypted and only a limited group of users (configurable per file or subdir) are able to read them. I already thought of using TrueCrypt, but I guess that this can support concurrent access via network...

I am working in a Microsoft Windows Active Directory environment.

If A wants to securely share files with B and C, only A, B, and C should be able to access those files. Noone else (not even system administrators) should be able to read the files. (Of course, if certificate, key and/or passwords are lost, the files won't be recoverable. That's a risk we would like to take...)

Any ideas on how to get that done?

Best Tom

  • 2
    If it's standard Office document (.docx, .xlsx, .pptx etc.0 then these have built-in encryption when you password protect the file through the Office application. Apart from the unnecessary route of encryption files and folders I don't see why you'd want to prevent your system admins from seeing files. Have you thought of a cloud solution that keeps the files off your network - OneDrive, for example - and then you could share the files off your network. Personally, i think you're over-thinking how secure you want your files to be unless you're the likes of MI5... – Kinnectus Oct 2 '18 at 16:26
1

It sounds like you need third-party encryption software such as GPG. GPG allows you to encrypt a file specifying which people are allowed to decrypt it. Your administrator will be able to see the encrypted files, but they should not be able to decrypt them.

5

By design, Domain Administrators in an Active Directory environment (assuming all-Windows PCs) either automatically have or may quickly obtain full control over nearly everything in their domain.

  • If you use BitLocker, they can force the recovery key to be stored in AD.
  • If you use EFS, they can install a 'data recovery agent' certificate.
  • If you use TrueCrypt, they can just wait until you unlock the volume.
  • If you share a folder via SMB 'File Sharing', they can access the administrative "whole disk" shares.
  • They can change firewall rules through Group Policy.
  • They can set arbitrary Registry settings through GPO.
  • They can run arbitrary commands on your computer through GPO boot/login scripts.

If your company hired Domain Admins which can't be trusted with the task, the only way to securely share data is to never reveal it to a domain machine – this includes the computers of A, B, and C.

(Well, it can still store encrypted data but it must be blind to what the data actually is – all access still must be through non-domain devices.)

1

As far as I know, there is no way to share individual files between computers that involves password and encryption on one of the computers and is proof against administrators. Even encrypted files can only be accessed by the user that encrypted them.

Therefore you would need to look elsewhere for your solution, meaning on the cloud. There file-sharing websites that keep the files in encrypted format and allow their sharing. Your local admins will have no way of forcing the access to your cloud-shared files.

One such service is SpiderOak which has a generous allocation of disk space for free accounts. You may share information between users by sending them URLs of the file or folder (actually you define a "room" that is a group of files that you wish to share under the same envelope). See the description in their article SpiderOak Share.

Another one is MEGA, which I stopped using as it has some peculiarities and more limitations on the free account.

You may also use Dropbox to share encrypted files, and there are products for doing the encryption.

There are other such services beside SpiderOak which I have tried, but finally settled on it as the one that gave me the most flexibility and space.

  • Encrypted files can be accessed by several users, depending on the system (usually a user key + master key are used, e.g. in EFS or PGP or LUKS). But a malicious admin can just wait until you access it, one way or another... – grawity Oct 3 '18 at 13:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.