Based on my understanding of AWS documentation it appears that the only way to encrypt at rest existing EFS instances with some data is to create new EFS instances with encryption enabled and copy the files from unencrypted EFS to encrypted EFS and alter mount points if any.
Can anybody confirm that is the case?
I've been desperately trying to find a way to backup my AWS EFS file system to S3, but cannot seem to find one.
There's several EC2 instances running all having access to the mentioned EFS. In order to reduce traffic, I already tried launching a Lambda Function, which SSHs to the EFS instances and runs "aws s3 sync ...". Unfortunately SSHing from Lambda services doesn't seem like a good production ready solution.
What I've also tried was adapting DataPipeline, but launching additional instances just for backups seems like a hassle, too.
Isn't there some easy way of backing up EFS to S3?
Any suggestions appreciated.
The home is mounted unencrypted on login.
I tried accessing it after doing 'su sampleuser', but it was encrypted, which is the expected behavior I guess.
I also tried changing the user's password, and then logging in, but I was redirected to the login.
So just to be sure: is there a way for root to access and decrypt a home folder from another user?
I am in the process of retiring an old Windows-integrated CA and bringing online a new, properly-configured one (several, actually). Most of our systems are unable to use EFS thanks to Group Policy... but due to some misconfiguration, a handful of domain users were able to autoenroll for EFS certificates. So far, none of the users are aware of any files they have encrypted, and searching through their files with cipher /u /n isn't finding anything... but I can't be sure that there are no encrypted files we have missed.
I must retire this CA soon, so I'll have to revoke the EFS certificates and ensure that EFS is totally disabled for those users. I really can't migrate the old CA to a new one either, for several reasons. So what are my options for shutting off EFS for those who may have been using it without losing their data?
I'm setting up some new Ubuntu servers, and I'd like to secure the data on them against theft. The threat model is attackers desiring the hardware or rather naïve attackers desiring the data.
Please take note of this section.
The threat model does not include smart attackers desiring the data; I presume they will do one or more of the following:
Splice a UPS into power cable in order to keep the machine running continuously.
Insert a pair of Ethernet bridges between the computer and the network termination point that will bridge the traffic over a wireless network of sufficient range that the host will maintain network connectivity.
Open the box and use a probe on the memory bus to grab interesting stuff.
Use TEMPEST devices to probe what the host is doing.
Use legal means (such as a court order) to force me to disclose the data
Etc. Etc.
So what I want is to have some, or ideally all, of the data on the disk on an encrypted partition, with the key material necessary to access it on external media of some sort. Two methods I can think of for storing the key material are:
Store it on a remote host accessible via the network, and configure enough of the network to retrieve it during the boot process. Retrieval would be allowed only to the IP address assigned to the secured host (thus not allowing access to the encrypted data if it were booted on another network connection) and could be disabled by administrators if the machine were discovered to be stolen.
Store it on a USB storage device that is made in some way significantly more difficult to steal than the host itself. Locating it remote from the host, such as at the end of a five meter USB cable leading off into another corner of the room, or even another room, would probably significantly decrease the chances of attackers taking it. Securing it in some way, such as by chaining it to something immobile, or even putting it into a safe, would work even better.
So what are my options for setting this up? As I said before, I'd prefer to have everything (aside from perhaps a small boot partition that does not contain /etc) encrypted, so that I don't have to worry about where I'm putting files, or where they're accidentally landing.
We're running Ubuntu 9.04, if it makes any difference.