PGP NetShare Command Line - 10.3 User's Guide

PGP™ NetShare Command Line

User's Guide

10.3

The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement.

Version 10.3.0. Last updated: January 2013.

Legal Notice

Symantec, the Symantec Logo, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Java is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED"AS IS"AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. “Commercial Computer Software and Commercial Computer Software Documentation”, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

Symantec Corporation 350 Ellis Street Mountain View, CA 94043

Symantec Home Page (

Printed in the United States of America.

10 9 8 7 6 5 4 3 2 1

http://www.symantec.com)

Contents

Introduction 3

About PGP NetShare Command Line 3 About PGP NetShare Command Line 3 Audience 4 System Requirements 4 Installing and Uninstalling 4 Upgrading to Version 10.1 or Above 5 Working with Group Keys 5

About Group Keys 5 Using Group Keys 5

Technical Support 6

Contacting Technical Support 6 Licensing and registration 7 Customer service 7 Support agreement resources 7

The Command-Line Interface 9

Overview 9 Scripting 10 Editing the Path on a System 10 Configuration File 11 Environment Variables 12

Creating Environment Variables 12 Passphrases 13 XML Output 14 Searching for Keys on Remote Servers 14

Commands 15

--version 16

--help (-h) 17

--encrypt (-e) 17

--decrypt 19

--reencrypt (-r) 21

--reencrypt-full 22

--reencrypt-delta 24

--reencrypt-clone 26

--list (-l) 27

--list-xml 27

--verify (-v) 28

--lock-all 29

--unlock 29

--set-driver 30

--get-driver 30

ii Contents

Options 33

--recipient (-r) 34

--recipient-owner 35

--recipient-operator 35

--recipient-remove 35

--recipient-xml 35

--group (-g) 36

--group-operator 36

--signer (s) 36

--signer-passphrase 37

--signer-passphrase-fd 37

--passphrase (-p) 37

--passphrase-fd 38

--adk 38

--public-keyring 38

--private-keyring 39

--universal-server 39

--auth-username 39

--auth-passphrase 40

--auth-passphrase-fd 40

--input (-i) 40

--output (-o) 40

--output-file 41

--home-dir 41

Flags 43

--verbose 43

--remote 44

--force 44

--halt-on-error 44

--local-mode 44

--preserve 45

--quiet 45

Quick Reference 47

Commands 47 Options 47 Flags 48

Automated Copying 49

Copying in Standalone Mode 49 Copying in Desktop Mode 49

Introduction

This guide provides information on how to use the PGP NetShare Command Line application.

In This Chapter

About PGP NetShare Command Line ...........................................................................3

Audience ...........................................................................................................................4

System Requirements..................................................................................................... 4

Installing and Uninstalling............................................................................................ 4

Upgrading to Version 10.1 or Above ............................................................................5

Working with Group Keys.............................................................................................. 5

Technical Support ........................................................................................................... 6

About PGP NetShare Command Line

PGP™ NetShare Command Line is a software product that lets a defined set of users access files in a shared, protected space (such as on a corporate file server, in a shared folder, or even removable media such as a thumb drive).

The files are protected by encryption, but continue to appear (to the users who have access rights) as normal application files. Anyone without access rights to the files, but who can access the shared space, can see the files but does not have access to the content.

PGP NetShare Command Line can be purchased as a standalone product, as one product among several products for example, Symantec Desktop Email or Symantec Drive Encryption), or as part of Symantec Encryption Desktop.

For more information about Symantec File Share Encyption, see the:

 Symantec Encryption Desktop User's Guide  Symantec File Share Encyption Quick Start Guide

About PGP NetShare Command Line

PGP NetShare Command Line gives you access to Symantec File Share Encyption functionality using a command-line interface.

4 Introduction

Audience

Accessing Symantec File Share Encyption functions from the command line is useful for scripting Symantec File Share Encyption functions, troubleshooting problems, or if the graphical user interface is not available.

Note: Not all Symantec File Share Encyption functions are available via the

command line.

PGP NetShare Command Line is always in one of two operation modes:

 desktop. Symantec Encryption Desktop is also installed on the system.  standalone. Symantec Encryption Desktop is not installed on the same system.

Run the --version command to see what operation mode PGP NetShare Command Line is in.

When you run the --help command, only those commands, options, and flags that are available in the current operation mode are displayed.

This User's Guide is for anyone who is going to be using PGP NetShare Command Line to perform Symantec File Share Encyption functions from the command line.

It assumes you are familiar with using Symantec File Share Encyption via the graphical user interface in the standalone product or as part of Symantec Encryption Desktop.

System Requirements

The system requirements for PGP NetShare Command Line are the same as for Symantec File Share Encyption itself; if Symantec File Share Encyption (standalone or as part of Symantec Encryption Desktop) installs on a system, PGP NetShare Command Line (pgpnetshare.exe) will also install and be usable.

Installing and Uninstalling

PGP NetShare Command Line (pgpnetshare.exe) is installed automatically when Symantec File Share Encyption is installed on a system.

The default location for either installation is: C:\Program Files\PGP Corporation\PGP Desktop\pgpnetshare.exe.

To uninstall PGP NetShare Command Line, simply uninstall Symantec File Share Encyption or Symantec Encryption Desktop.

Upgrading to Version 10.1 or Above

Changes were made to PGP NetShare Command Line in Version 10.1, resulting in some commands, options, and flags from previous versions being removed.

If you scripted previous versions of PGP NetShare Command Line, make sure to check your scripts to ensure that they do not reference commands, options, or flags that are no longer in the product.

Working with Group Keys

Starting with PGP Universal Server 3.2 and PGP NetShare Command Line 10.2, your Symantec Encryption Management Server administrator can create group keys that you can use with PGP NetShare Command Line.

Note: Group keys are different than using Active Directory groups. Using a group key

adds only the single key to a protected folder. Using an Active Directory group adds every key found for members of that group.

Upgrading to Version 10.1 or Above

Introduction 5

About Group Keys

Using Group Keys

The group key is intended to be used as a single key to encrypt or decrypt Symantec File Share Encyption-protected files and folders.

The group key can be created by Symantec Encryption Management Server administrators only. Intended to be used with active synchronization with Active Directory, the group key reduces the overhead associated with encrypting a file/folder to a large number of keys. Your Symantec Encryption Management Server administrator can map file server access/encryption policies to Active Directory security groups.

Note: For detailed information about creating group keys, refer to the Symantec

Encryption Management Server Administrator's Guide or contact your Symantec

Encryption Management Server administrator.

When a member of the group associated with the group key leaves your organization or no longer requires access to protected folders, you should re-encrypt your folders to ensure access is denied to that member.

To use group keys with PGP NetShare Command Line:  To encrypt or re-encrypt using the public portion of a group key, specify it on the

command line when using the --recipient command.

6 Introduction

Technical Support

 To unlock, re-encrypt, or decrypt using the private portion of a group key in a

Technical Support

Symantec Technical Support maintains support centers globally. Technical Support’s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates.

Symantec’s support offerings include the following:

 A range of support options that give you the flexibility to select the right amount

 Telephone and/or Web-based support that provides rapid response and up-to-the-

 Upgrade assurance that delivers software upgrades  Global support purchased on a regional business hours or 24 hours a day, 7 days a

 Premium service offerings that include Account Management Services

For information about Symantec’s support offerings, you can visit our Web site at the following URL:

www.symantec.com/business/support/

All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy.

Symantec Encryption Management Server-managed environment, authenticated access to the Symantec Encryption Management Server managing the desired group key is required. Under these circumstances PGP NetShare Command Line will automatically use the enrolled user's information to authenticate.

standalone environment, you must specify the Symantec Encryption Management Server managing the desired group key, the user and the user's passphrase on the command line in order to access the private portion of the group key.

of service for any size organization

minute information

week basis

Contacting Technical Support

Customers with a current support agreement may access Technical Support information at the following URL:

www.symantec.com/business/support/

Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem.

When you contact Technical Support, please have the following information available:

 Product release level  Hardware information  Available memory, disk space, and NIC information  Operating system  Version and patch level  Network topology  Router, gateway, and IP address information  Problem description:

 Error messages and log files  Troubleshooting that was performed before contacting Symantec  Recent software configuration changes and network changes

Licensing and registration

If your Symantec product requires registration or a license key, access our technical support Web page at the following URL:

www.symantec.com/business/support/

Introduction 7

Technical Support

Customer service

Customer service information is available at the following URL:

www.symantec.com/business/support/

Customer Service is available to assist with non-technical questions, such as the following types of issues:

 Questions regarding product licensing or serialization  Product registration updates, such as address or name changes  General product information (features, language availability, local dealers)  Latest information about product updates and upgrades  Information about upgrade assurance and support contracts  Information about the Symantec Buying Programs  Advice about Symantec's technical support options  Nontechnical presales questions  Issues that are related to CD-ROMs or manuals

Support agreement resources

If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows:

Asia-Pacific and Japan customercare_apac@symantec.com

8 Introduction

Technical Support

Europe, Middle-East, Africa

semea@symantec.com

North America, Latin America supportsolutions@symantec.com

The Command-Line Interface

This section describes the command-line interface of PGP NetShare Command Line.

In This Chapter

Overview ........................................................................................................................... 9

Scripting .........................................................................................................................10

Editing the Path on a System.......................................................................................10

Configuration File .........................................................................................................11

Environment Variables.................................................................................................12

Passphrases....................................................................................................................13

XML Output .................................................................................................................... 14

Searching for Keys on Remote Servers......................................................................14

Overview

PGP NetShare Command Line uses a command-line interface. You enter a valid command at the command prompt and press Enter. PGP NetShare Command Line responds appropriately based on what you entered (if you entered a valid command) or with an error message (if you entered an invalid or incorrectly structured command).

All PGP NetShare Command Line commands have a long form: the text "pgpnetshare", a space, two hyphens "--", and then the command name.

For example:

C:\>pgpnetshare --help [Enter]

is the command to display the built-in help information.

(The command prompt, C:\>, and [Enter] will no longer be shown in examples.)

A few commands also have a short form: one hyphen and then a single letter that substitutes for the command name. For example:

pgpnetshare -h

is the short form of the command to access help.

Short forms of commands are noted where appropriate.

10 The Command-Line Interface

Scripting

PGP NetShare Command Line commands can easily be inserted into scripts for automating common tasks, such as creating a Protected Folder, re-encrypting a Protected Folder, or verifying files and folders in a Protected Folder.

PGP NetShare Command Line commands can easily be added to scripts written with scripting languages such as Perl or Python.

Editing the Path on a System

By default, the PGP NetShare Command Line application, pgpnetshare.exe, is installed in C:\Program Files\PGP Corporation\PGP Desktop\.

To use PGP NetShare Command Line using the Windows Command Prompt application, you need to navigate to the PGP NetShare Command Line directory to execute commands (or the commands will fail).

If you wish to be able to execute PGP NetShare Command Line commands from any location when using Windows Command Prompt, you need to change the path on the system to include the location of the PGP NetShare Command Line application.

To add the PGP NetShare Command Line application to your path on a Windows 7 or Vista system:

1 On the Windows desktop, right click the Computer icon, then select Properties. 2 On the left side of the System Control Panel screen, click Advanced System

Settings.

3 If you are prompted for permission to continue, click Continue. 4 At the bottom of the System Properties screen, click Environment Variables. 5 In the System Variables section at the bottom of the Environment Variables

screen, select Path, then click Edit.

6 At the end of the existing Variable value line, enter a semicolon (;), then add the

path to the PGP NetShare Command Line application

7 Click OK to save the change, then close the windows you opened.

To add the PGP NetShare Command Line application to your path on a Windows XP or 2000 system:

1 On the Windows desktop, right click the My Computer icon, then select

Properties.

2 On the System Properties dialog, click the Advanced tab. 3 At the bottom of the Advanced tab, click Environment Variables. 4 In the System Variables section at the bottom of the Environment Variables

screen, select Path, then click Edit.

5 At the end of the existing Variable value line, enter a semicolon (;), then add the

path to the PGP NetShare Command Line application.

6 Click OK to save the change, then close the windows you opened.

Configuration File

The PGP NetShare Command Line configuration file holds settings that affect how PGP NetShare Command Line works.

The PGP NetShare Command Line configuration file (PGPprefs.xml) cannot be changed by PGP NetShare Command Line itself: any changes need to be edited manually.

The PGP NetShare Command Line configuration file is located:

 Windows XP: C:\Documents and Settings\[Local User]\Application Data\PGP

Corporation\PGP\.

 Windows 7 and Vista: C:\Users\[Local User]\AppData\Roaming\PGP

Corporation\PGP\.

Note: Configuration file settings in PGPprefs.xml are shared among all Symantec

Encryption Desktop applications on the system.

The Command-Line Interface 11

Configuration File

Configuration file settings you can use with PGP NetShare Command Line are:  Output File (CLoutputFile). Specifies the output file (default is not set in the

configuration file; defaults to stdout). The output file is used for output messages. See --output-file for more information.

 Private keyring file (privateKeyringFile). The filename or path and filename

to the private keyring file. The default is secring.skr, located in the default PGP NetShare Command Line home directory. See --private-keyring for more information.

 Public keyring file (publicKeyringFile). The filename or path and filename to

the public keyring file. The default is pubring.pkr, located in the default PGP NetShare Command Line home directory. See --public-keyring for more information.

 Keyservers (keyservers). Specifies the keyserver(s) to be searched for keys.  Always encrypt to keys (alwaysEncryptToKeys). Specifies keys that should

always be added implicitly when encrypting and re-encrypting.

 Configured Symantec Encryption Management Server (adminGroupServer).

Specifies the Symantec Encryption Management Server used for activity logging, key and Active Directory group queries. Only available in configured installs with Symantec Encryption Desktop.

 Enrollment Cookie (adminConfigCookie). Authenticates the user against a

Symantec Encryption Management Server for an operation. Only available in configured installs with Symantec Encryption Desktop.

 Location Blacklist (blackListContent, enableBlackList). Entries in the

Blacklist specify those locations that should never be encrypted by PGP NetShare Command Line.

 Organization ADK (ADKKeyID, useADK). Specifies the centralized organization

ADK (Additional Decryption Key). Usually only available in configured installs with Symantec Encryption Desktop.

12 The Command-Line Interface

Environment Variables

 Policy ADK (policyADK, usePolicyADK). Specifies a policy-specific ADK.

Usually only available in configured installs with Symantec Encryption Desktop.

 Manage Individual Files (allowAdvancedUserMode). Controls whether the user

is allowed to manage (encrypt, decrypt, or re-encrypt) single files, as opposed to folders that might contain files.

Environment Variables

PGP NetShare Command Line behavior can be changed using environment variables.

Environment variables have the lowest priority compared to the command line and the configuration file. Settings for either will override environment variables. However, if a value for an item is not specified on the command line or in the configuration file, the environment variable will be used. Environment variables cannot be disabled; if they are present, they are implemented. To disable an environment variable, remove it. Setting a Boolean environment variable will activate it, regardless of the value to which it is set.

Environment variables that can be implemented for PGP NetShare Command Line are:  PGP_LOCAL_MODE. This is a Boolean environment variable that forces PGP

NetShare Command Line to run in local mode. The default is unset. See --local- mode for more information.

Usage: PGP_LOCAL_MODE=1

 PGP_HOME_DIR. This is a string environment variable that overrides the default

home directory, pointing it to the path supplied in the variable. The default is unset. See --home-dir for more information.

Usage: PGP_HOME_DIR=C:\Documents and Settings\<current user>\Application Data\PGP Corporation\PGP\

 PGP_PASSPHRASE. This is a string environment variable that lets you set your

passphrase. The default is unset. See --passphrase for more information.

Usage: PGP_PASSPHRASE="1Killer*Whale"

Creating Environment Variables

PGP NetShare Command Line lets you create environment variables to control certain behaviors.

To create an environment variable on a Windows 7 system:

1 Right click the Computer icon on your desktop and choose Properties. 2 On the System window, click on Advanced system settings in the left pane. 3 On the System Properties window, select the Advanced tab and then click on

Environment Variables near the bottom of the window.

4 In the User Variables section of the Environment Variables screen, click New. 5 In the Variable name field, enter a name for the variable you are creating.

The Command-Line Interface 13

Passphrases

For example, if you were setting the PGP_HOME_DIR environment variable, you would enter:

PGP_HOME_DIR

6 In the Variable value field, enter a value appropriate for the variable you are

creating.

For example, if you were setting the PGP_HOME_DIR environment variable, you could enter:

C:\PGP\PGPhomedir\

7 Click OK.

The Environment Variables screen reappears. The environment variable you created displays in the User variables list.

8 Click OK. 9 On the System Properties window, click Apply then click OK. 10 Close the System window.

Passphrases

For consistency, all example passphrases in this guide are shown in single quotation marks ('). Putting passphrases between single quotation marks ensures that reserved characters and spaces are interpreted correctly when entered on the command line.

If you do not use any reserved characters or spaces in your passphrases, then you do not have to enclose them in single quotation marks.

On Windows systems, if you have a space in a passphrase, you must enclose the passphrase in single or double quotation marks when you enter it on the command line. Also, double quotation marks (") as part of the passphrase must be escaped with a preceding double quotation mark.

For example, if you want to use

Thomas "Stonewall" Jackson

as your passphrase, you would have to enter it as

'Thomas ""Stonewall"" Jackson'

on the command line. You need the quotation marks at the beginning and end for the spaces and you need to escape each double quotation mark used in the passphrase with another double quotation mark.

Note: If you are having problems entering certain characters in your passphrases,

check the information about how to handle reserved characters for the operating system or shell interpreter you are using.

14 The Command-Line Interface

XML Output

PGP NetShare Command Line gives you the option to save some output in XML format.

If you desire properly formatted XML output, do not copy the XML output from the console window and then paste it; this could introduce extraneous newline characters into the output.

Instead, use either of these two methods:

 Use the --output-file option.

pgpnetshare --list-xml <XMLcontent> output-file 'c:\acllistxml'

 Pipe the output directly to a file:

pgpnetshare --list-xml <XMLcontent> > 'c:\acllist-xml'

Searching for Keys on Remote Servers

By default, PGP NetShare Command Line searches for keys on the local system.

If you want PGP NetShare Command Line to search for keys on a remote keyserver, a Symantec Encryption Management Server for example, you must explicitly tell it to search there.

There are two commands to search for keys on a remote keyserver:  --universal-server searches for keys on the specified Symantec Encryption

Management Server.

 --remote searches for keys on the specified keyserver.

Commands

This section describes PGP NetShare Command Line commands:

 --version, which displays PGP NetShare Command Line version information.  --help, which provides a brief description of the commands and options available

in PGP NetShare Command Line.

 --encrypt, which creates a Protected Folder and specifies who can access the

files.

 --decrypt, which decrypts an existing Protected Folder and the files in it.  --reencrypt, which modifies who can access files in a Protected Folder.  --reencrypt-full, which modifies who can access files in a Protected Folder

and reencrypts the files.

 --reencrypt-delta, which reencrypts files and folders in delta mode.  --reencrypt-clone, which reencrypts files and folders in clone mode.  --list, which lists the file or folder access control list (ACL).  --list-xml, which lists the file or folder ACL in XML format.  --verify, which displays information about the specified protected file or

directory.

 --lock-all, which clears symmetric keys cached by PGP NetShare Command

Line

 --unlock, which unlocks a file or folder.  --set-driver, which sets the state of the PGP NetShare Command Line driver,

active or passive.

 --get-driver, which displays the current state of the PGP NetShare Command

Line driver, active or passive.

16 Commands

--version

In This Chapter

--version.......................................................................................................................... 16

--help (-h) ........................................................................................................................17

--encrypt (-e)...................................................................................................................17

--decrypt .........................................................................................................................19

--reencrypt (-r) ...............................................................................................................21

--reencrypt-full .............................................................................................................. 22

--reencrypt-delta ...........................................................................................................24

--reencrypt-clone...........................................................................................................26

--list (-l) ...........................................................................................................................27

--list-xml .........................................................................................................................27

--verify (-v)......................................................................................................................28

--lock-all..........................................................................................................................29

--unlock ...........................................................................................................................29

--set-driver......................................................................................................................30

--get-driver .....................................................................................................................30

--version

The --version command displays information about the version of PGP NetShare Command Line you are using, including the current operation mode: desktop or standalone.

The usage format is:

pgpnetshare --version [options]

Where:

[options] let you modify the command. Options are:

--verbose, which displays additional information about the operation.

Examples:

pgpnetshare --version

PGP NetShare Command Line responds with version information in the format:

PGP NetShare Command Line version 10.3.0 (Build 8228), mode(desktop)

--help (-h)

Commands 17

--help (-h)

The --help command provides a brief description of the commands, options, and flags available in PGP NetShare Command Line.

Only the commands, options, and flags that are available for the current operation mode (desktop or standalone) are displayed when you run --help.

The long form is:

pgpnetshare --help

The short form is:

pgpnetshare -h

The response to either version of the --help command is:

PGP NetShare command line tool.

Usage: PGPNetShare – action [--options,...]

--encrypt (-e)

The --encrypt command encrypts a specified file or directory and specifies who can access the files. Use --encrypt for the initial creation of a shared space protected by Symantec File Share Encyption, called a Protected Folder.

If you specify a directory to be encrypted, all files and directories under that directory are recursively encrypted; do not specify any files or directories under the directory you specify. Directories are marked as Protected Folders and files in those zones are protected.

You must designate the users who can access the files in the Protected Folder using the key IDs of their PGP keys. The key ID of a PGP key in Symantec File Share Encyption or Symantec Encryption Desktop is shown on the Key Properties screen for the key. To find a key ID, go to the PGP Keys control box, select All Keys, right click on the key whose key ID you want to know, select Key Properties, then find the ID field on the Key Properties screen. You do not need to enter the leading 0x of the key ID.

To specify multiple users or groups who can access the files in the Protected Folder, use the --recipient command once for each user or the

--group command once for

each group.

If you specify a recipient who is required to use an ADK, that recipient and the ADK user will both appear on the access control list (ACL); meaning both will have cryptographic access to the protected files.

The usage format is:

18 Commands

--encrypt (-e)

pgpnetshare --encrypt <input> [input2 ...] --recipient <user>

--group <group_name> --signer <signer> --passphrase <phrase> -

-public-keyring <pubring> --private-keyring <priring> --output <target> --universal-server <server> --adk <adkkey> --outputfile <logoutput> [ --halt-on-error --local-mode --remote -preserve --verbose ]

Where:

 --encrypt is the command specifying that a Protected Folder be created.

<input> is the directory or file to be encrypted. You can list multiple

directories or files if desired.

 --recipient is the option specifying that the listed users are to be part of

the ACL being created for the Protected Folder being created. The ACL lists those users who have cryptographic access to the files in the Protected Folder.

<user> is the key ID of a PGP key (EFDDCE3C, for example) on the system on which you are running PGP NetShare Command Line. These can be either the keypairs or the public keys of the users who will be added to the ACL. If you specify a public key, those users must have the corresponding private key on their system when they attempt to access files in the Protected Folder.

 --signer is the option specifying the user on the local system whose

private key will be used to sign the files in the Protected Folder.

<signer> is the key ID of the PGP keypair whose private key will be used to sign the files in the Protected Folder. This user must have a private key on the local system. This user does not have to be listed as a recipient, meaning this user does not have to be someone who can access the files in the Protected Folder once it is created.

 --passphrase is the option specifying the passphrase of the private key

being used to sign the files in the Protected Folder being created.

<phrase> is the actual passphrase of the private key being used to sign the files in the Protected Folder.



--group is the option specifying that you want the members of an Active Directory group to be able to access the files in the Protected Folder being created. You are not required to use this option.

<group_name> is the name of an Active Directory group that includes the users you want to be able to access the files in the Protected Folder.

 --public-keyring is the option specifying that a public keyring file

should be used for an operation

<pubring> is the filename of the public keyring file.

 --private-keyring is the option specifying that private keyring file

should be used for an operation.

<priring> is the filename of the private keyring file.

 --output is the option specifying a target location to be used for an

operation.

<target> is the path to the target location.

 --universal-server is the option specifying that a Symantec Encryption

Management Server be used for an operation.

Commands 19

--decrypt

<server> is the specific Symantec Encryption Management Server to use.

 --adk is the option specifying that an Additional Decryption Key (ADK) be

used for an operation.

<adkkey> is the key ID of the ADK to be used.

 --output-file is the option specifying that messages be written to a log

file for an operation.

<logoutput> is the path to the log file.

Optional flags are:

 --halt-on-error, which stops operation if an error occurs.  --local-mode, which forces the use of local mode; passphrase and keyring

caches are not enabled or used.

 --remote, which searches for keys on a remote keyserver.  --preserve, which preserves certain file attributes.  --verbose, which displays additional information about the operation

being performed.

Example:

 pgpnetshare --encrypt C:\Projects\HR\ProjectX --recipient

EFDDCE3C --recipient CCB81F3C --recipient C092007E --signer EFDDCE3C --passphrase '1Killer*Whale '

In this example, the folder "ProjectX" is being turned into a Protected Folder; all files and folders in that folder will be protected using encryption by Symantec File Share Encyption. Three users are on the ACL; meaning only they will be able to access the files, Alice Cameron (EFDDCE3C), Jose Medina (CCB81F3C), and Ming Pa (C092007E). Alice Cameron's private key, which is on the local system, is being used to sign the files in the Protected Folder, and the passphrase to her key is provided.

 pgpnetshare --encrypt C:\Projects\HR\ProjectX

--group HR4 --

signer EFDDCE3C --passphrase '1Killer*Whale'

In this example, the folder "ProjectX" is being turned into a Protected Folder; all files and folders in that folder will be protected using encryption by Symantec File Share Encyption. The users in the Active Directory group HR4 will be added to the ACL, meaning only those users will have cryptographic access to the files in the Protected Folder. The private key of Alice Cameron (EFDDCE3C), which is on the local system and who is in the specified Active Directory group, is being used to sign the files in the Protected Folder, and the passphrase to her key is provided.

--decrypt

The --decrypt command decrypts the specified files or directories. The short form is d.

Using this command takes a Protected Folder or files and removes Symantec File Share Encyption encryption from it. Use this command when you no longer need the Protected Folder. All files and folders in the subfolder will be decrypted.

20 Commands

--decrypt

If you specify a directory to be decrypted, all files and directories under the target directory are recursively decrypted. If you specify a directory, do not specify any files or directories under the directory you specify.

The usage format is:

pgpnetshare --decrypt <input> [input2 ...] --passphrase <phrase> --public-keyring <pubring> --private-keyring <priring> --output <target> [ --halt-on-error --local-mode -preserve --verbose --force ]

Where:

 --decrypt is the command specifying that the files/folders in the Protected

Folder be decrypted.

<input> is the files or directories to be decrypted.

 --passphrase is the option specifying that the passphrase of the private

key used to sign the files in the Protected Folder needs to be used.

<phrase> is the actual passphrase of the private key used to sign the files in the Protected Folder.

 --public-keyring is the option specifying that a public keyring file

should be used for an operation

<pubring> is the filename of the public keyring file.

 --private-keyring is the option specifying that private keyring file

should be used for an operation.

<priring> is the filename of the private keyring file.

 --output is the option specifying a target location to be used for an

operation.

<target> is the path to the target location.

Optional flags are:

 --halt-on-error, which stops operation if an error occurs.  --local-mode, which forces the use of local mode; passphrase and keyring

caches are not enabled or used.

 --preserve, which preserves certain file attributes.  --verbose, which displays additional information about the operation

being performed.

 --force, which searches for keys on a remote keyserver.

Examples:

pgpnetshare --decrypt C:\Projects\HR\ProjectX\ --passphrase '1Killer*Whale'

In this example, the folder "ProjectX" is being decrypted; all files and folders in that folder will no longer be protected as part of a Protected Folder. The passphrase to the private key on the local system being used to sign the files is provided.

--reencrypt (-r)

The --reencrypt command creates a new ACL from scratch that replaces an existing ACL. Files and folders that are no currently protected will be encrypted using the new ACL. The short form is -r.

--reencrypt changes the metadata of already encrypted files but does not re-encrypt the encrypted data.

This allows you to easily modify who can access the files in the Protected Folder without having to reencrypt the files themselves, which is a longer process and not necessary if you are simply changing access rights.

The usage format is:

Where:

Commands 21

--reencrypt (-r)

pgpnetshare --reencrypt <input> [input2 ...] --recipient <user> [-recipient <user> ...] <signer> --passphrase <phrase> --public-keyring <pubring> -private-keyring <priring> --output <target> --universal-server <server> --adk <adkkey> [ --halt-on-error --local-mode -remote -- preserve --verbose ]

 --reencrypt is the command specifying that the ACL is going to change

and then be reencrypted.

<input> is the files or directories affected by the --reencrypt command.

--group <group> --signer

 --recipient is the option specifying that the listed users are to be added to

the ACL, giving them cryptographic access to the files in the Protected Folder.

<user> is the key ID of a PGP key (EFDDCE3C, for example) on the local system that you are adding to the ACL.



--group is the option specifying that you want the members of the listed Active Directory group to be able to access the files in the Protected Folder. You are not required to use this option.

<group> is the name of an Active Directory group that includes the users you want to be able to access the files in the Protected Folder.

 --signer is the option specifying the user on the local system whose

private key will be used to sign the files in the Protected Folder.

<signer> is the key ID of the PGP key whose private key will be used to sign the files in the Protected Folder. This user must have a private key on the local system.

 --passphrase is the option specifying the passphrase of the private key

being used to sign the files in the Protected Folder being created.

<phrase> is the actual passphrase of the private key being used to sign the files in the Protected Folder.

 --public-keyring is the option specifying that a public keyring file

should be used for an operation

<pubring> is the filename of the public keyring file.

22 Commands

--reencrypt-full

 --private-keyring is the option specifying that private keyring file

should be used for an operation.

<priring> is the filename of the private keyring file.

 --output is the option specifying a target location to be used for an

operation.

<target> is the path to the target location.

 --universal-server is the option specifying that a Symantec Encryption

Management Server be used for an operation.

<server> is the specific Symantec Encryption Management Server to use.

 --adk is the option specifying that an Additional Decryption Key (ADK) be

used for an operation.

<adkkey> is the key ID of the ADK to be used.

Optional flags are:

 --halt-on-error, which stops operation if an error occurs.  --local-mode, which forces the use of local mode; passphrase and keyring

caches are not enabled or used.

 --remote, which searches for keys on a remote keyserver.

Example:

--reencrypt-full

The --reencrypt-full command creates a new ACL from scratch that replaces an existing ACL and reencrypts both the ACL and the encrypted files themselves. This allows you to modify who can access the files in the Protected Folder and reencrypt the files themselves at the same time.

 --preserve, which preserves certain file attributes.  --verbose, which displays additional information about the operation

being performed.

pgpnetshare --reencrypt C:\Projects\HR\ProjectX -r ABCD1234 -r EFGH5678 --signer EFDDCE3C --passphrase '1Killer*Whale'

In this example, an existing Protected Folder (C:\Projects\HR\ProjectX) is having two additional users added (the users whose PGP key IDs are ABCD1234 EFGH5678). The key ID of a private key that was already on the ACL (EFDDCE3C) is being used to sign the files in the Protected Folder, and the passphrase to that key is provided.

Note: Symantec Corporation recommends using the --reencrypt-full command

whenever you remove a user or group from the ACL or whenever you are refreshing the ACL when users have been removed from a group. This strengthens the security of your Symantec File Share Encyption files.

The usage format is:

Commands 23

--reencrypt-full

pgpnetshare --reencrypt-full <input> [input2 ...] --recipient <user> [-recipient <user> ...]

--group <group> --signer <signer> --passphrase <phrase> --public-keyring <pubring> -private-keyring <priring> --output <target> --universal-server <server> --adk <adkkey> [ --halt-on-error --local-mode -remote -- preserve --verbose ]

Where:

 --reencrypt-full is the command specifying that the ACL is going to

change and then be reencrypted and that the files in the Protected folder are to be reencrypted.

<input> is the files or directories affected by the --reencrypt-full command.