Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure.

The environment will be NetApp SAN with SafeNet encryption switch and a vSphere cluster with numerous Linux VMs.

Note that it is the system administration of the Linux OS that I am interested in - not the administration of the encryption-switch.

How am I able to work on the commandline with the data decrypted? Does one normally encrypt everything on disk (i.e. including the system files) or just certain volumes/partitions containing the data?

I assume that a key management server facilitates the process but could someone provide specifics?

Many thanks!

share|improve this question
I can't understand what you are asking. What problem are you trying to solve? How will you know when it is solved? What are you trying to achieve? What are your security goals? (If you are asking about system administration, particularly of specific products, your question is probably better suited to ServerFault, where system administration is on topic.) – D.W. Apr 15 '13 at 17:38
I am asking what the process is to gain administrative access to the decrypted data on the filesystem when the data is being encrypted on a SAN by an encryption switch. – Jason Apr 15 '13 at 19:18
Maybe I'm thinking about this all wrong... Perhaps it's completely transparent to the admin. Perhaps the VMs run some kind of SafeNet encryption agent? – Jason Apr 15 '13 at 21:29
It is my understanding that SafeNet provides Layer 2 encryption--a couple of layers below the Application layer that SSH is running. Given that, all system administration via SSH should be seamless once the network is set up. – Motoma Apr 17 '13 at 20:07
We really need to understand the exact setup. Is it SafeNet Storage Encryption product in front of NetApp SAN? Or is there a regular ethernet crypto gateway of theirs on each end? They have quite a few products that each work a bit differently. – Nick P Apr 17 '13 at 23:35

This is really a system administration question rather than security. However, I'm going to go ahead and attempt an answer. Most of Safenet's product's try to ensure a transparent form of encryption that the user doesn't notice. So, if it's encrypted storage the product performs the encryption just before it hits whatever integrated storage solution. If it's encrypted networking, they usually have two products (one for each side) that establish a tunnel and seemlessly move things through. Even the coprocessors are integrated with common libraries so you don't really have to modify some applications.

A proper setup with your storage using something like Storage Encryption product should cause no trouble. Your side of things should change little or not at all. They reiterate that in their datasheet:

"SafeNet StorageSecure offers a seamless, non-disruptive deployment that drops into the network between clients and servers, linking them with a high-speed cryptographic path. There are no hosts to configure or software to install. StorageSecure is ready to encrypt and secure storage transparently without any impact on user experience."

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.