Encrypting file folders on OS X Server but needs to be cross plateform

Question

We have OS X server 10.4 and 10.5. We have been asked by our client to implement some demanding security policies. One is to have our files encrypted on our file server for more sensitive files. This is in case there is a breach in the network and access is gained to the server the data is still secure. Well we work in a mix platform environment but there are very few options on the Mac for encyrpting folders that aslo work on the PC. PGP desktop looks to be the only option but from some of the reviews looks kinda buggy and there network version is only for the PC.
Anyone else run into this problem and what was your solution?
Thanks!
Steve
Message was edited by: Steve Burns1

Answer 1

This is certainly an interesting problem and an interesting requirement. On the face of it, a quite difficult problem.
As for your requested approach here, I don't know of an available and cross-platform distributed authentication and distributed encryption and distributed auditing scheme.
I'd expect most folks presented with this problem and with this requirement would carefully control access onto the LAN and into the data, and would encrypt the traffic. And would bury the data inside a secured server or secured server farm.
There's a particular and fundamental consideration here. If the client or the server security is breached, then folder or file encryption is itself vulnerable each and every time the folder or file contents are decrypted for use. (It's the system that allows you to decrypt and access the folder and file data. If you don't trust the client or the server, then you'll have to consider whether or not you trust providing your key(s) for decryption. And what happens when a user's key is exposed.)
With cross-platform or client-server remote file access operations as proposed in your approach, you've just extended the security perimeter around all the boxes involved, and it's wicked hard to revoke the data access keys in these sorts of environments.
Most folks will "bunker" the critical data, rather than spreading the perimeter around, and will manage and maintain and audit the (encrypted) channels into the data. More copies of the data -- whether currently encrypted or otherwise -- means more headaches. Keeping the data close and being able to remotely revoke the access keys is invaluable.
As for remote access, you might find an encrypting or kerberized NFS (krb5p being the gonzo setting) useful. This encrypts the traffic. And you can zonk the access keys via the KDC.
ZFS (and encryption is itself just starting to be being baked into ZFS) is just starting to come on-line, and likely isn't fully and sufficiently widely available for your needs yet. ZFS might eventually provide what you want here. But again, auditing client access is hairy. It only takes one bone-headed clear-text data export from one client, or one compromised client or lost password, after all.
Or the classic pgp or zip can be used to toss the files around, and with varying degrees of cryptographic security. Of course everybody ends up with the keys to the kingdom pretty quickly, with the difficulties in auditing and revoking data access that are inherent in distributed access, and one compromised client or one lost laptop can potentially ruin the whole plan.
A custom solution build on NFS or such is very likely feasible, but it won't be cheap. You'd likely need to insert your own network-capable "disk" drivers into the Windows I/O stack, for instance. (This has been done before...)
Don't forget to consider password recovery, too. Both to permit it or to have a carefully controlled "back-door" into the data (which has its own risks), and to avoid the social engineering attacks that can arise here.
(I'd be interested to hear more about this and whatever solution you might eventually choose here, too. This looks to be a very knotty problem.)
And OK, so I'm over-thinking it all.