2

I know that there is a very similar question to that Is NFS Secure Over Internet, but I am asking a little bit different.

I guess that NFS is not so secure, as I can learn from the internet and from that question.

Are there any very secure methods to use in order for your employees to have access to some files you want to be very secure?

Let's say it a little different. If NSA for example, has some documents, lets say top secret, and wants those documents to be available to its employees (NSA may want each employee to have access to different documents according with what they are working on) but no-one else, and under no circumstances someone from inside or outside of the agency could have access to files that should not see, what NSA may do?

I am not just asking for NFS here, but everything that NSA could use to achieve it's purpose.

closed as off-topic by jasonwryan, Anthon, slm, rahmu, manatwork Dec 6 '13 at 16:50

  • This question does not appear to be about Unix or Linux within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    This question appears to be off-topic because it belongs on Information Security. – jasonwryan Dec 6 '13 at 8:49
  • @jasonwryan however I am asking about current linux solutions – John Smith Dec 6 '13 at 9:40
  • 1
    I'll add that give this scenario, the best bet form NSA security prospective probably is use something like a cripted usb flash drive plus a trusted courier plus an employee computer totally disconnected from internet. Or even better is to force the employee to travel to a secure NSA facility. – DavAlPi Dec 6 '13 at 9:45
  • 1
    If you want security, encrypt the documents you share. – Emmanuel Dec 6 '13 at 10:21
  • 1
    NSA practices for keeping secrets this way are secret. – goldilocks Dec 6 '13 at 13:52
1

Are there any very secure methods to use in order for your employees to have access to some files you want to be very secure?

Your original link mentions sshfs, which uses the SSH 2.0 protocol, which seems to be considered secure, and not to be confused with SSL 2.0, which is considered insecure as there are known methods to crack it.

There are also file sharing applications (e.g. proFTP) which can use TLS. TLS is about as secure as you can get, I believe.

The specific cipher used will affect the level of security. AES is available for all of the above and supported by the the U.S National Institute of Standards and Technology. This is an independent body concerned with commerce and communication, but also (non-military) government communication. You don't have access to military encryption systems, obviously, but beyond an element of "security through obscurity", those probably don't have an edge over anything in the public sphere.

There are rumors that the NSA has systems capable of cracking AES encryption. These imply a tremendous amount of hardware is required, so in this case (presuming such rumors are true), you can only spy on some of the people some of the time.

  • aes256 should be pretty secure, though. – Nils Dec 6 '13 at 14:07
  • @Nils : I agree. I think there are a lot of smart "white hat" security types and if there really were a way around brute forcing a key, it would end up public. And the math on brute force looks absurd; it's not feasible. The development of quantum computers may pose a serious threat to contemporary cryptography, but we don't have to worry about that yet. – goldilocks Dec 6 '13 at 14:19
  • Sure? This IEEE article is 9 years old... – Nils Dec 8 '13 at 21:52
1

sshfs was already mentioned - this is what we are migrating to if https is no option.

NFSv4 with encryption might be a possible way, too - I never used it myselv.

But if I were you and would have to share a few documents to a number of people, with no need to actually mount isos or anything else, I would go for https.

BUT: Be sure to enable strong ciphers and disable weak ciphers.

The same is true for SSH (where you never ever should use protocol 1 any more).

Not the answer you're looking for? Browse other questions tagged or ask your own question.