PGP Portable Quick Start Guide Version 10.3

Transcription

1 Quick Start Guide Version 10.3 Introduction to Use to distribute encrypted files to users who do not have software. Use to transport files securely to other systems that do not or cannot have PGP software installed. provides: Portability of secured documents Ease of distribution of secured documents There are two types of users of : the user who creates the Disk containing secured data, and the user who does not have PGP software but needs to access that secured data. You might also be both types of users: creating a Disk that you can take and use on a computer at a customer's site, for example. Contents Introduction to (page 1) Terms Used in (page 1) Creating Disks (page 1) Accessing Data on a Disk (page 3) Logging Messages (page 5) Recovering Data using an ADK (page 5) Using the Command Line Tool (page 5) Getting Assistance (page 7) Terms Used in Term Creation Disk Definition The name of the product that includes both the application to create Disks and to access those disks. The application itself that is used to create a Disk on a flash drive, removable drive, CD, DVD, or other device, drive or media on which a PGP Portable Disk is created. The collection of files that, together, provide access to protected data on a system that does not have PGP software installed. It includes the Disk File, a Windows executable, a Mac OS X executable, and an autorun file. Term Disk File Definition The actual file that contains your encrypted data. The Disk file is a.pgd file. Creating Disks Disks can be created in one of two ways: using a Windows Explorer shortcut menu, or using a command line tool. This section describes normal use of the shortcut menu. For information on the command line, see Using the PGP Portable Command Line Tool (on page 5). To create a Disk, be sure that you: Have installed on a Windows system that is already running. Properly licensed the installation that is bound to a Symantec Encryption Management Server. Are using a Windows BIOS-based system. ( is not compatible with Windows UEFI-based systems.) A Disk can be created on one of two targets: A folder on a local drive, remote file share, or CD/DVD. A locally mounted removable device, such as a USB flash drive, that is no larger than 128 GB. When you create a Disk, Symantec Encryption Management Server policy also enforces passphrase strength. If you use a passphrase that does not meet Symantec Encryption Management Server policy, an error message is displayed. Creating a Disk from a Folder When you want to eventually burn a CD or DVD containing the Disk, use this option. Note: Be sure that you have copied the data you want to protect and share into the folder. To create a Disk from a folder 1 Locate and right-click the source folder, and then select Create Disk Folder from the shortcut menu. 2 In the Create Disk dialog box, enter and confirm the passphrase. This passphrase will be required to access the data in the Disk. 3 Click Create. 1

2 If the folder you are using to create the Disk is on a read-only device (such as CD or DVD), a Save As dialog box is displayed. Browse for the location on your local drive where you want the PGP Portable Disk destination folder to be created and click Save. When completed, the destination folder is created. The folder name is the source folder name with "-PGP Portable" appended to the name. 4 Burn the entire contents of the destination folder to the CD/DVD. The Disk destination folder contains: The Windows executable (pgpportable.exe) The Mac OS X executables (PGP Portable App) A Windows autorun file (autorun.inf) A Disk File (pgpportable.pgd) The Disk File (pgpportable.pgd) contains within it all files found in the original target folder. The Disk File is encrypted to the passphrase specified. Be sure that you do not delete any of these files from the Disk. Tip: Be sure that you burn only the contents of the folder to disc, and not the folder itself. If you burn the folder to a disc, will not automatically launch on systems where autorun is enabled. Creating a Disk from a Removable USB Device When you want to create the Disk directly onto a removable USB device, such as a flash drive, use this option. Removable USB devices, such as a flash drive, that are larger than 4 GB must be formatted as NTFS. NTFS drives are treated as read-only when accessed on Mac OS X systems (unless a third-party program, such as NTFS-3G for Mac OS X, is used to enable read-write access). Disks created on removable USB devices that are smaller than 4 GB can be formatted as FAT or NTFS. Symantec Corporation recommends that you create PGP Portable Disks on FAT formatted removable devices. If you try to create a Disk that is larger than 4 GB, PGP will automatically convert the filesystem of the removable device to NTFS with NTFS permissions similar to FAT. If you want to create a Disk on an NTFS formatted removable device, be sure that you understand NTFS permissions, as you may create a disk that cannot be modified by anyone but the creator. Note: The removable USB device must be smaller than 128 GB ( bytes). If you attempt to create a PGP Portable Disk on a removable USB device that is larger than 128 GB, you will receive an error message. Note: When creating a Disk on USB drives that are 256 MB or smaller, folders created on the disk cannot be renamed using Mac OS X systems. Create Disks on USB drives larger than 256 MB if Mac OS X users will want or need to rename folders. To create a Disk from a removable USB device 1 Locate and right-click the mounted removable USB device, and then select Create Disk from the shortcut menu. 2 The Disk creation application is displayed with a warning that the contents of the drive will be erased. 3 In the Create Disk dialog box, to securely erase any data that exists on the device, select the check box to Securely erase contents of the disk. 4 To require the user of the Disk to change the passphrase on first use (the first time the user inserts the device into the system), select the check box to Change passphrase on first use. This option is useful if you plan to create several Disks to be handed out, such as at a conference or trade show. 5 Enter and confirm the passphrase. This passphrase will be required to access the data in the Disk. 6 Click Format. When completed, the Disk is created. The Disk File is encrypted to the passphrase specified. 7 You are prompted to enter the passphrase and then the Disk is mounted. A notification message is displayed from the system tray informing you of the drive number for the mounted Disk. 8 If desired, copy the data that you want to protect to the mounted Disk. The Disk contains no files when it is first created. 9 Unmount the Disk (in the system tray, click the icon and select Unmount and Exit). The drive that was mounted for the Disk is unmounted. 10 Properly eject the USB device and remove the device from your computer. You can now access the contents of the Disk on another system that supports PGP Portable. Warning: Be sure that you properly unmount a removable USB device before physically removing it from the system. Failure to do so may result in corrupted file contents. The removable device contains the following files: The Windows executable (pgpportable.exe) The Mac OS X executables (PGP Portable.app) A Windows autorun file (autorun.inf) The Disk File (pgpportable.pgd) 2

3 Be sure that you do not delete any of these files from the Disk. Creating Read/Write or Read-Only PGP Portable Disks To have read/write access to a Disk, the PGP Portable Disk must be located on read/write media (such as a flash drive or other removable disk). Read/write access is enabled for a Disk only while it resides on the removable device on which it was created. Disks created on read-only media are themselves read-only (for example, CD-ROMs). Disks accessed on the removable device on which they were created are read/write (for example, a USB drive that is mounted as read-write). Accessing Data on a Disk Disks are not compatible on Windows 8/8.1or Mac OS X systems. The contents of a Disk can be accessed in three ways: By mounting the CD, DVD, or removable USB drive on a Windows system, and running the Disk application (which launches automatically if autorun is enabled). By mounting the CD, DVD, or removable USB drive on a Mac OS X system, and running the Disk application. When you access data on a Disk, remember that you are actually mounting two items: the removable device on which the Disk resides, and the Disk itself (which is mounted as a separate item). When you are finished, be sure to unmount the Disk before safely ejecting the removable device. The steps to access data on a Disk are similar for Windows and Mac OS X systems. Warning: Be sure that you properly unmount a removable device before physically removing it from the system. Failure to do so may result in corrupted file contents. To access data on a Disk using a Windows system 1 Insert the removable device on which the 2 Do one of the following: On Windows systems where autorun is enabled, select Mount Disk. On Windows systems where autorun is disabled, open the mounted removable device and browse for the application (pgpportable.exe). Double-click the application. On Windows 7 systems, open the disk by doubleclicking the USB disk icon in Windows Explorer. The dialog box is displayed. 3 Enter the passphrase for the Disk. The PGP Portable Disk is mounted. Note: If the creator of the Disk requires that the passphrase be changed on first use, when the disk is first inserted into a drive after creation, the dialog box that appears requires that you enter the current passphrase, and then change and confirm the new passphrase. A notification message is displayed from the system tray informing you of the drive number for the mounted PGP Portable Disk, and the amount of disk space used and available. If the Disk is mounted as a readwrite device, you can add data to it. If the Disk is mounted as a read-only device, you cannot add data. Note: The volume name for the Disk is unique to and may not match the name of the volume when created. 4 When you are finished using the Disk, unmount the Disk (in the system tray, click the icon and select Unmount and Exit. The drive that was mounted for the Disk is unmounted. 5 Properly eject the USB device or disc from your computer. To view available disk space To view available disk space and total size of the PGP Portable Disk once the disk has been mounted, move your cursor over the task bar item for a few seconds. The notifier message reappears and displays the mount status of the Disk as well as the updated disk space information. To obtain additional information about To obtain more information about, in the left bottom corner of the dialog box, click the link for More Info. Your browser launches and the Symantec Corporation Support site page is displayed. To access data on a Disk using a Mac OS X system 1 Insert the removable device on which the 2 Open the mounted removable device and browse for the application (). Double-click the application. The dialog box is displayed. 3

4 3 Enter the passphrase for the Disk. Note: If the creator of the Disk requires that the passphrase be changed on first use, when the disk is first inserted into a drive after creation, the dialog box that appears requires that you enter the current passphrase, and then change and confirm the new passphrase. When the correct passphrase has been entered, the PGP Portable Disk is mounted. If the Disk is mounted as a read-write device, you can add data to it. If the Disk is mounted as a read-only device, you cannot add data. Note: The volume name for the Disk is unique to and may not match the name of the volume when created. 4 When you are finished using the Disk, unmount the Disk (in the dock, click the icon and then click Unmount. The drive that was mounted for the Disk is unmounted. 5 Properly eject the USB device or disc from your computer. Warning: Be sure that you properly unmount a removable device before physically removing it from the system. Failure to do so may result in corrupted file contents. To view available disk space To view available disk space and total size of the PGP Portable Disk once the disk has been mounted, select the icon in the dock. If is still calculating the amount of free space, the message Calculating available space is displayed. To obtain additional information about To obtain more information about, in the left bottom corner of the dialog box, click the link for More Info. Your browser launches and the Symantec Support site page is displayed. Changing the Passphrase for a PGP Portable Disk There may be times when it is necessary to change the passphrase associated with a Disk. Note that you cannot change the passphrase on any Disk that is read-only (including Disks burned to CD/DVD media). To change the passphrase on a Disk using a Windows system 1 Insert the removable device on which the 2 Do one of the following: On Windows systems where autorun is enabled, select Mount Disk. On Windows systems where autorun is disabled, open the mounted removable device and browse for the application (pgpportable.exe). Double-click the application. On Windows 7 systems, open the disk by doubleclicking the USB disk icon in Windows Explorer. 3 Enter the passphrase for the Disk when prompted. The Disk is mounted. A notification message is displayed from the system tray informing you of the drive number for the mounted PGP Portable Disk. 4 Open by right-clicking the system tray icon and choosing Open. 5 In the dialog box, click Change Passphrase. 6 Enter the current passphrase, enter and confirm the new passphrase, and click Change. The passphrase is changed. The Passphrase Quality bar provides a basic guideline for the strength of the passphrase you are creating. For more information, see The Passphrase Quality Bar. To change the passphrase on a Disk using a Mac OS X system 1 Insert the removable device on which the 2 Open the removable device and locate the application (). Double-click the application, and enter the passphrase for the Disk when prompted. When the correct passphrase has been entered, the Disk is mounted. 3 Open by clicking the icon in the dock and in the dialog box, clicking Change Passphrase. 4 Enter the current passphrase, Enter and confirm the new passphrase, and click Change. Unmounting a Disk Be sure that you properly unmount a removable device before physically removing it from the system. Failure to do so may result in corrupted file contents. To unmount a Disk 1 Open. To do this, do one of the following: 4

5 To open on a Windows system, rightclick the system tray icon and choose Unmount and Exit. To open on a Mac OS system, click the icon in the dock and choose Unmount and Exit. The Disk is unmounted. 2 Safely eject and remove the device from your system. Logging Messages When a new Disk is created, a log message is sent to the Symantec Encryption Management Server. The message appears in the client log. For USB-based Disks: Portable Disk Create: User [login name] on machine [computer name] created a USB-based disk osf size [disk size] bytes (Disk ID=[disk UUID], vendor=[usb vendor ID] '[USB vendor name]', product=[usb product ID] '[USB product name]', s/n=[usb serial number]) For folder-based Disks: Portable Disk Create: User [login name] on machine [computer name] created a folderbased disk of size [disk size] bytes (DiskID=[disk UUID]) Recovering Data using an ADK If Symantec Encryption Management Server policy specifies that an Additional Decryption Key (ADK) be used with all PGP Portable operations (such as encrypting messages), then all Disks are encrypted to that ADK. This ensures that Disk can be accessed if the passphrase is forgotten or unavailable. The addition of the ADK to the Disk is automatic and transparent to the user. For more information on the ADK, refer to your Symantec Encryption Desktop for Windows User's Guide or your Symantec Encryption Management Server Administrator's Guide. To use an ADK to access a Disk, you must be using a system on which is installed and you must have access to the private portion of the ADK as well as the passphrase for it. ("Access" means you are using the system on which the ADK was created, or have imported the ADK on a token or into on another system.) To access a Disk using an ADK 1 Insert the removable device on which the 2 If autorun is enabled, when prompted for the passphrase click Cancel. 3 Browse for and double-click the Disk file (.pgd) on the device. 4 When prompted for the passphrase, enter the passphrase for the ADK. 5 When the correct passphrase has been entered, the PGP Portable Disk is mounted. If the device is mounted as a read-write device, you can add data to the Disk. If the device is mounted as a read-only device, you cannot add data. Using the Command Line Tool includes a command-line application, pgpp.exe, for the creation of Disks. The application can create a Disk from a folder or from a USB drive. Although the commands for creating these two types of Disks are similar, they are described separately for ease of use. pgpp.exe also supports options that let you view the online help, see what version of pgpp.exe you are using, and control the message display settings. These options are not required to create Disks. pgpp.exe commands can easily be inserted into scripts written with scripting languages such as Perl or Python. By default, pgpp.exe is installed in C:\Program Files\PGP Corporation\PGP Desktop\ on Windows systems. To use pgpp.exe from the Windows Command Prompt application, you must either navigate to this directory to execute commands or change the path on the system to include the location of pgpp.exe. Folder The usage format for creating a Disk from a folder is: pgpp create <source-folder> --output <target-folder> --user-name <username> -- passphrase <phrase> --volume-name <volname> Where: create is the command to create a Disk. <source-folder> is the path to the folder you want to be encrypted. --output specifies that a Disk folder is to be created by this operation. <target-folder> is the path to the Disk folder created by this operation. --user-name specifies that a passphrase user will be used to authorize the operation. <username> is the username of the passphrase user. --passphrase specifies that a passphrase will decrypt the Disk folder being created. 5

6 <phrase> is the passphrase the end user will enter to decrypt the Disk. --volume-name specifies the name for the volume you are creating. If --volume-name is omitted, the default name, PGPSECURED, will be used. <volname> is the name for the folder you are creating. If you use --volume-name, you must enter text for <volname>; you will see an error if no text is entered or if you enter a space in quotation marks. Example: pgpp create c:\dir1 --output c:\dir2 -- user-name "Alice Cameron" --passphrase 'Frodo*1*Baggins22' --volume-name 'Encrypted' --noprompt This example shows a Disk being created from the contents of the directory C:\dir1 on the local system. It will be located on the local system at C:\dir2. The user on the system authorizing the operation is Alice Cameron. The passphrase to access the encrypted data in the folder is 'Frodo*1*Baggins22' (without the quotation marks). The volume will be called 'Encrypted' (without the quotation marks). Only errors and warnings will appear when the command is executed. USB drive The usage format for creating a Disk from a USB drive is: pgpp create <usb-drive> --usb --user-name <username> --passphrase <phrase> --volumename <volname> Where: create is the command to create a Disk. <usb-drive> is the path to the USB drive on the local system. --usb specifies that a Disk folder is to be created from the specified USB drive. --user-name specifies that a passphrase user will be used to authorize the operation. <username> is the username of the passphrase user. --passphrase specifies that a passphrase will decrypt the Disk folder being created. <phrase> is the passphrase the end user will enter to decrypt the Disk. --volume-name specifies the name for the volume you are creating. If --volume-name is omitted, the default name, PGPPORTABLE, will be used. <volname> is the name for the USB disk you are creating. If you use --volume-name, you must enter text for <volname>; you will see an error if no text is entered or if you enter a space in quotation marks. Example: pgpp create f: --usb --user-name "Alice Cameron" --passphrase 'Frodo*1*Baggins42' - -volume-name 'PGP-USB' This example shows a Disk being created on a USB drive, drive f on the local system. The user on the system authorizing the operation is Alice Cameron. The passphrase to access the encrypted data in the folder is 'Frodo*1*Baggins42' (without the quotation marks). The volume will be called 'PGP-USB' (without the quotation marks). No message display level is set, so errors, warnings, and normal status information will display when the command is executed. Additional Options pgpp.exe supports several options: --help, which displays the online help. --version, which displays information about the version of pgpp.exe you are using. Options that control what is displayed when a command is executed. These options are not required to create Disks. --help The --help option displays the pgpp.exe online help, which shows supported commands and options. The usage format is: pgpp --help The online help appears. --version The --version option displays which version of pgpp.exe you are using. The usage format is: pgpp --version The version information appears. --change-passphrase The --change-passphrase option is used to force the user to change the original passphrase on first use of the PGP Portable disk. The usage format is: pgpp create <usb-drive> --usb --user-name <username> --passphrase <phrase> --volumename <volname> --change-passphrase The disk is created requiring the user change the passphrase on first use. 6

7 Message Display Settings pgpp.exe provides several options that control what messages are displayed when a command is executed: Quiet mode (--quiet). Nothing gets displayed. No prompt mode (--noprompt). Only errors and warnings get displayed. Normal mode. Displays errors and warnings, plus some status information. This option is used if nothing is specified on the command line. Verbose mode (--verbose). Displays all Normal mode information, plus additional status information. To specify a message display mode other than Normal, simply use it on the command line. For example: pgpp create c:\dir1 --output c:\dir2 -- passphrase 'Frodo*1*Baggins22' --verbose This command creates a Disk from a folder in Verbose mode. All errors, warnings, and status information will appear when the command is executed. Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support web page at the following URL: Customer service Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals 7

8 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, Africa North America, Latin America Copyright and Trademarks Copyright (c) 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Norton Zone, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Java is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. 8