Sharing and Reading Encrypted Data with Windows and Linux Clients

This Use Case describes how to read and share encrypted data from a Windows or Linux client sharing a CTE GuardPoint and an LDT policy where the Windows and Linux Clients share the same storage.

Requirements & Specifications

Prerequisites

1. Create Windows AccessOnly clients.

2. Create Linux Clients.

3. Have a CipherTrust Manager setup and ready to accept CipherTrust Transparent Encryption clients.

4. Install CTE agent for Windows or Linux on the clients and register the CTE clients to the CipherTrust Manager.

5. Create an LDT policy on CipherTrust Manager.

Overview

In this scenario:

• The Linux and Windows clients share storage.

• The Linux and Windows clients will reside in separate client groups.

• The Linux clients will reside in both an LDT Communication Group and a client group.

• The Linux client will encrypt the file. The Linux LDT primary has to completely finish initial transformation before any Windows client can guard.

• The Windows clients will not reside in an LDT Communication Group.

• The Windows clients must be Windows AccessOnly clients.

• The Windows AccessOnly clients can access and read and write the content, but LDT will never run on them.

Creating the Setup

1. Create an LDT Communication Group for the Linux clients.

2. Add the Linux clients to the LDT Communication Group.

   

3. On CipherTrust Manager, create a Windows Client Group and a Linux Client Group.

   

4. Add the Windows AccessOnly clients to the Windows Client Group.

5. Add the Linux clients to the Linux client group.

6. Create the GuardPoint ONLY in the Linux Client Groups using the LDT policy on CipherTrust Manager.

   1. Select the LDT policy that you created.

   2. Mount the same path on each client machine, for example: /root/lw/CTE/gp1

7. Once Linux has fully completed initial data transformation, and the status is REKEYED, then create the GuardPoint in the Windows Client Group. All Windows access-only clients will now be able to guard and access the files.

   a. Select the LDT policy that you created.

   b. Guard the path on Windows clients, for example: \192.168.11.50\cifs28_wg_ldtnas01\vgp

Now both the Windows AccessOnly clients, and the Linux clients, can access and read the files in the GuardPoint.

Limitations

When rotating an encryption key, you must disable the GuardPoint from the Windows AccessOnly client group first. After rekey is completed, enable/guard the AccessOnly node GuardPoint again.

Reference

• Sharing LDT NFS/CIFS GuardPoints between Linux and Windows