Disk encryption

Security > Disk encryption turns on BitLocker for the system drive of Windows machines and keeps every recovery key where it cannot be lost. It also backs up the recovery keys of machines that were encrypted before Gardience, and gives every Linux drive encrypted with LUKS a recovery key it holds. Only admins see this page.

Encrypting the drives that hold controlled unclassified information is CMMC requirement 3.13.16 (protect CUI at rest). On Security > CMMC Level 2, the check for it passes once a machine's system drive is encrypted.

Why the recovery keys matter#

An encrypted machine starts on its own: its security chip (TPM) unlocks the drive. If the chip, the motherboard, or the start-up files change, the machine asks for its recovery key instead. Without that key, the data on the drive is gone for good. Nobody can get it back, Gardience included.

So Gardience never encrypts a machine until each of its recovery keys is kept in two places: in Gardience's vault, and in a copy outside the Gardience server. The machine itself checks the same thing again before it starts encrypting.

Where the recovery keys are kept#

• Gardience's vault. Each key is sealed with the vault key, and it is in every Gardience backup.
• The recovery kit. One file with every machine's recovery key, encrypted so that only your organization's private key opens it. Gardience emails a new version to your recovery contacts whenever a key is added, and an admin can download it at any time. It opens with standard OpenSSL, without Gardience, so the keys outlive the Gardience server.
• Active Directory or Microsoft Entra ID, if you choose. When a machine is joined to one, Windows also backs its key up there.

Recovery keys travel from each machine to Gardience encrypted with that machine's own key, so they never appear in clear text in Salt's job records or logs.

1. Set up the recovery kit#

1. Open Security > Disk encryption.
2. Enter a passphrase of 12 characters or more, twice, and choose Create the recovery key pair.
3. Your browser downloads gardience-recovery-key.pem, the private key, encrypted with that passphrase. Gardience keeps only the matching certificate. It never keeps the private key or the passphrase.
4. Keep the file and the passphrase somewhere other than the Gardience server: a password manager, a safe, or a USB drive kept offline. Keeping the file and the passphrase in different places is safer still.
5. Choose I saved the private key and its passphrase. Until you do, Gardience prepares and encrypts nothing.

Organizations with their own certificate authority can use their own certificate instead (an RSA key of 2048 bits or more): open Use your organization's own certificate instead and paste it.

Recovery contacts are the addresses the kit is emailed to. Without any, it goes to the security contact in the CMMC system profile, or else to the addresses under Administration > Settings > Email. Email has to be set up for the kit to be sent; without it, download the kit after keys are added.

2. Prepare and encrypt machines#

1. Tick the machines in the list. It comes in sections (ready to encrypt, needs a step first, encrypting, encrypted) with a search box and pages; your ticks are kept across pages and searches.
2. Choose Prepare the chosen machines. Gardience installs BitLocker where it is missing and adds a recovery key to the system drive, without encrypting anything. Windows Server needs a restart after BitLocker is installed: the page offers to restart it, then prepare it again. Tick Also back up to Active Directory or Also back up to Entra ID to keep a copy there too.
3. The new keys go into the vault and into a new recovery kit, which is emailed. If it could not be emailed, choose Download the recovery kit.
4. When a machine shows Ready to encrypt, tick it and choose Encrypt the chosen machines. Gardience turns on BitLocker with the TPM and XTS-AES 256, encrypting the used space first, so most machines finish within minutes. The machine stays in use while it encrypts.

A machine that cannot be encrypted yet says why in the Next column, for example "no ready TPM (security chip)" or "the recovery kit with its key has not been emailed or downloaded yet".

With Change tickets required (Administration > Settings), enter the ticket before preparing or encrypting. Every step is recorded in the audit log.

Each day, Gardience backs up every recovery key on every Windows machine, including machines encrypted outside Gardience, and emails a new kit when there are new keys. Back up keys now does the same at once.

When a machine asks for its recovery key#

The recovery screen shows a key ID. Either:

• In Security > Disk encryption, type the first 8 characters of the key ID under A recovery screen shows a key id, choose Find, and choose Show next to that key. Showing a key is recorded in the audit log.

• Without Gardience, open the latest recovery kit:

  Copy

  openssl cms -decrypt -inform PEM -in gardience-recovery-kit.pem -inkey gardience-recovery-key.pem

  OpenSSL asks for the passphrase. The kit lists each machine, its key ID, and its recovery password.

Linux#

On Linux, the encryption for data at rest is LUKS. Gardience shows which drives are encrypted, and Security > CMMC Level 2 checks the system drive.

Prepare gives each LUKS drive a recovery key that Gardience holds, the same way it holds BitLocker keys:

1. Choose the Linux machines and Prepare the chosen machines. If a drive opens at boot with a key file listed in /etc/crypttab, Gardience uses that file. Otherwise, type the drive's current passphrase in Current LUKS passphrase. It is sent encrypted for that machine alone, used once to add the key, and never kept.
2. Gardience adds a new key slot with a random recovery key, checks that the new key opens the drive, and only then puts it in the vault and in a new recovery kit. Nothing else on the drive changes: no key slot is removed and nothing is re-encrypted.
3. The kit lists the key as luks:<drive UUID>:<key slot>. At a boot prompt that asks for the passphrase of luks-<UUID>, type the recovery key.

If someone later removes that key slot, the machine's Next column says so, and Prepare adds a new one.

Gardience does not encrypt a running Linux server's system drive: doing that in place risks the server, and the usual practice is to encrypt it when the server is built (the Linux installer's encryption option, or the cloud's disk encryption on AWS, Azure, or Google Cloud).

Good to know#

• Encryption needs a ready TPM. Virtual machines need a virtual TPM: on AWS, the TPM editions of the Windows images (NitroTPM).
• Replacing the recovery certificate makes a new kit with every key. Kits made before keep needing the old private key, so keep it too.
• Machines with BitLocker turned on outside Gardience keep their own settings; Gardience backs up their keys.