Changeset 55484 in vbox
- Timestamp:
- Apr 28, 2015 1:49:36 PM (9 years ago)
- File:
-
- 1 edited
-
trunk/doc/manual/en_US/user_AdvancedTopics.xml (modified) (9 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/doc/manual/en_US/user_AdvancedTopics.xml
r55479 r55484 3732 3732 3733 3733 <para> 3734 Starting with VirtualBox 5.0 it is possible to encrypt the data stored in3734 Starting with VirtualBox 5.0, it is possible to encrypt the data stored in 3735 3735 hard disk images transparently for the guest. It does not depend on a specific 3736 3736 image format to be used. Images which have the data encrypted are not portable … … 3756 3756 3757 3757 <listitem> 3758 <para>This feature is currently closed source and requires the Oracleextension3758 <para>This feature is currently closed source and requires the VirtualBox extension 3759 3759 pack to be installed to work.</para> 3760 3760 </listitem> 3761 3761 3762 3762 <listitem> 3763 <para> Because encryption works only on the stored user data3764 it is not possible to check for metadata integrity of the disk image currently.3765 Attackers might take advantage of this to remove or insert blocks of data base3763 <para>Since encryption works only on the stored user data, 3764 it is currently not possible to check for metadata integrity of the disk image. 3765 Attackers might take advantage of this to remove or insert blocks of data 3766 3766 into the image or change certain metadata items such as the disk size.</para> 3767 3767 </listitem> … … 3775 3775 <listitem> 3776 3776 <para>The DEK is kept in memory while the VM is running to be able to 3777 decr pt data read and encrypt data written by the guest. While this should3777 decrypt data read and encrypt data written by the guest. While this should 3778 3778 be obvious the user needs to be aware of this because an attacker might be able 3779 3779 to extract the key on a compromised host and get access to the data later.</para> … … 3781 3781 3782 3782 <listitem> 3783 <para>When encrypting or decrypting the images the password is passed unencrypted3784 via the Main API from the frontend to VBoxSVC. This needs to be kept in mind 3783 <para>When encrypting or decrypting the images, the password is passed unencrypted 3784 via the Main API from the frontend to VBoxSVC. This needs to be kept in mind, 3785 3785 especially when using third party frontends which make use of the webservice 3786 3786 where the password might be transmitted unencrypted over the network.</para> … … 3789 3789 <listitem> 3790 3790 <para>Encrypting images with differencing images is only possible if there 3791 are no branches exisiting. This limitation will be lifted in the future.</para> 3791 are no branches. This limitation may be addressed in a future 3792 VirtualBox version.</para> 3792 3793 </listitem> 3793 3794 … … 3801 3802 <para> 3802 3803 Encrypting disk images can be done either using the GUI or VBoxManage. 3803 While the GUI is easier to use it works on a per VM basis and encrypts3804 While the GUI is easier to use, it works on a per VM basis and encrypts 3804 3805 all disk images attached to the specific VM. 3805 3806 With VBoxManage one can encrypt individual images (including all differencing 3806 images). To encrypt an unencrypted medium with VBoxManage use:3807 images). To encrypt an unencrypted medium with VBoxManage, use: 3807 3808 </para> 3808 3809 … … 3832 3833 3833 3834 <para> 3834 When a VM is started using the GUI a dialog will open where the user3835 When a VM is started using the GUI, a dialog will open where the user 3835 3836 needs to enter all passwords for all encrypted images attached to the VM. 3836 If another frontend like VBoxHeadless is used the VM will be paused as soon3837 If another frontend like VBoxHeadless is used, the VM will be paused as soon 3837 3838 as the guest tries to access an encrypted disk. 3838 3839 The user needs to provide the passwords through VBoxManage using the following … … 3848 3849 <computeroutput>--removeonsuspend "yes|no"</computeroutput> to specify whether 3849 3850 to remove the password from VM memory when the VM is suspended. Before the VM can be 3850 resumed the user needs to supply the passwords again. This is useful when3851 resumed, the user needs to supply the passwords again. This is useful when 3851 3852 a VM is suspended by a host suspend event and the user doesn't want 3852 th at the password remainsin memory.3853 the password to remain in memory. 3853 3854 </para> 3854 3855 </sect2> … … 3858 3859 3859 3860 <para> 3860 In some circumstan es it might be required to decrypt previously encrypted3861 In some circumstances it might be required to decrypt previously encrypted 3861 3862 images. This can be done in the GUI for a complete VM or using VBoxManage 3862 3863 with the following command:
Note:
See TracChangeset
for help on using the changeset viewer.

