From owner-freebsd-questions@FreeBSD.ORG Thu Jun 16 16:33:51 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8BA6B16A41C for ; Thu, 16 Jun 2005 16:33:51 +0000 (GMT) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3DE6D43D1D for ; Thu, 16 Jun 2005 16:33:51 +0000 (GMT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.13.1/8.13.3) id j5GGXoEa022141; Thu, 16 Jun 2005 11:33:50 -0500 (CDT) (envelope-from dan) Date: Thu, 16 Jun 2005 11:33:50 -0500 From: Dan Nelson To: Tony Shadwick Message-ID: <20050616163347.GB14991@dan.emsphone.com> References: <20050615180436.Q30082@mail.goinet.com> <20050616031022.GA14991@dan.emsphone.com> <20050616111512.L30082@mail.goinet.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050616111512.L30082@mail.goinet.com> X-OS: FreeBSD 5.4-STABLE X-message-flag: Outlook Error User-Agent: Mutt/1.5.9i Cc: freebsd-questions@freebsd.org Subject: Re: GnuPG in the enterprise X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jun 2005 16:33:51 -0000 In the last episode (Jun 16), Tony Shadwick said: > On Wed, 15 Jun 2005, Dan Nelson wrote: > >In the last episode (Jun 15), Tony Shadwick said: > >>Are there any good documents out there on managing GnuPG in the > >>enterprise? > >> > >>There are basic issues I need to be able to address, such as a > >>situation when an employee leaves a company. The admin needs to > >>have the rights to revoke that user's public key, and be able > >>decrypt any old messages to that user, and be able to decrypt > >>messages sent to that user that are now being redirected to someone > >>else for handling. > >> > >>Are there established mechanisms for handling centralized key > >>management in a company to where the Administrator has access to > >>everything required? > > > >One solution is to make a copy of all keys (with known passphrases) > >when they are created, and put the copy in a secure location. If an > >employee leaves suddenly, you can retrieve the key to decrypt > >leftover files and revoke the key. Pgp.com's Windows PGP software > >uses special Revoker keys and Additional Decryption keys that get > >added when files are signed, so files are always encrypted to > >multiple recipients and keys are always revokable even if the > >original key no longer exists. gpg doesn't recognize ADKs, though. > > Just so I'm following then, let's say I have gnupg installed on my server, > and I'm creating all of my employee's secret keys there, then installing > gnupg on their workstations so that they can use local mail clients to > encrypt. > > What's to prevent them from chaning their secret key passphrase or > revoking the key themselves and creating a new public key, then publishing > that to the keyservers? (Other than knowing enough about gnupg in the > first place to do any of this of course...) Nothing. The first case should actually be common, since the passphrase is just another password, and all passwords should be changed occasionally. Remember you still have a copy of their key with a known passphrase. As for the second, you could remove the key-generating code from gpg, assuming you have also locked down the accounts/filesystems to prevent them from running unauthorized binaries (i.e. their own gpg). > Not to mention I've always wondering how gnupg plays with multiple > recipients or internal company mailing lists. For example if I send > a message to VIP1, VIP2, and VIP3, and it is an important internal > document that requires encryption, when I encrypt the message, won't > it get encrypted with VIP'1 public key, thus VIP2 and VIP3 won't be > able to open the message? It's up to your MUA to fetch the ids for all the recipients and then call gpg with all the required keyids. Mutt, for example does a pretty good job at this. If you ask for a message to be signed, it won't send it until it has ids for every recipient. -- Dan Nelson dnelson@allantgroup.com