Using EFS to Encrypt Files Across the Network
- Using EFS to Encrypt Files Across the Network
- Trusted for Delegation
- Local Profiles
Windows 2000 expert Bill Boswell discusses how to use the Encrypting File System to encrypt files across the network on file servers.
In this article, we'll discuss encrypting files across the network on file servers. This turns out to be something of a trick, as we'll see. Refer to Figure 1 for a diagram of the transactions involved in encrypting files on a file server.
){kind=link}
EFS transactions for encrypting server-based files
The key to understanding server-based file encryption is to keep in mind that the process used by EFS to issue and access public and private keys requires the user who encrypted a file to have a local profile on the machine where the file resides. These keys are used to lock and unlock the file encryption key (FEK) that ultimately decrypts the file. The user profile must contain both the public key to encrypt the FEK and the private key to decrypt the FEK.
The private EFS key in the user profile is encrypted with the user's master key. This master key is a hash of various components that include the user's password hash. Under normal circumstances, a file server could not create a local copy of the master key because it does not have access to the user's password hash. Only a domain controller has this information.
If you attempt to encrypt a file on a server that is not a domain controller, you will get a "Keyset does not exist" error. This is EFS telling you that it cannot encrypt the file because the necessary cryptographic plumbing is not in place. There is a workaround, though, that involves a special feature of the Kerberos authentication protocol that allows a ticket to be forwarded.
Kerberos Ticket Forwarding
Using Kerberos, it is possible for a file server to obtain a copy of a user's password hash by impersonating the user when requesting a copy of the hash from a domain controller. This impersonation requires that the client obtain a Kerberos ticket-granting ticket and session ticket, and then give these tickets to the file server. The client flags the tickets as forwardable. This permits the file server to send them on to a domain controller on behalf of the client.