tiCrypt 2.18.1

Share Drives

Sharing a drive grants another user access to that drive's encryption key. Sharing is not a filesystem permission that the server enforces on your behalf: because tiCrypt stores only ciphertext it cannot decrypt, the only way for someone else to read a drive is for them to hold a key for it. This is why sharing requires the Get drive keys (needed to share and attach drives) permission, and why the effect of sharing is different from what a shared folder does elsewhere.

Why sharing hands over a key

The server cannot grant access on your behalf. On a conventional system, an administrator can add someone to an access list and the filesystem enforces it. In tiCrypt the data at rest is opaque to the server, so access is granted by giving out a key rather than by editing a list. The practical consequence is that sharing is an act by the data owner, not by an administrator.

Revoking access stops future mounts, not past reads. Unsharing removes a user's ability to mount the drive from that point on. It cannot retract what they have already decrypted and read. Treat sharing as a disclosure decision, not a reversible toggle.

Co-owning a VM implies drive access. Adding a user as a co-owner of a VM configuration gives them access to that VM's drives, because co-owners need drive access to manage the machine. If you want a colleague to use a machine without reading everything on it, give them a lower VM role rather than co-ownership.

Project tags on a drive are a classification, not a label. Tagging a drive with a project records which regulatory regime its contents fall under, which is what makes the audit trail meaningful. Removing or forcing a project tag is a declassification action and requires the corresponding project-management permission.

Before you begin

• You have the Share drives and Get drive keys (needed to share and attach drives) permissions.
• If the drive is tagged with a project, you are active in that project. Share and Unshare from everyone else are not offered otherwise.
• The recipient is an active user. Project membership is not required to receive a share, but for a project-tagged drive the recipient can use the drive only while their membership in that project is satisfied.
• The drive is not attached to any VM if you are changing its project.

Add or Change a Project in a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to add or change the project.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, select a project to tag the drive.
7. Click Classify.

tip

Check your changes in the drive. The project tag name displays by the drive in the list or in the drive details under the drive owner name.

Confirmations, Errors & Solutions

Did Not Select Any Project

No change made.

Classified Project in Drive

Classify drive-name to project-name(total-classifying-time).

Failed to Classify Project in Drive

You cannot modify drive-name's project while it is attached to a VM.

Detach the Drive Before Changing Its Project

A drive's project cannot be changed while the drive is attached to any VM, read-write or read-only. Detach the drive from every VM it is attached to, then change the project.

To Virtual Machine Owner
To detach the drive, follow the steps in 

Detach a Drive from an Existing VM.

Forcefully Add or Change a Project in a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to add or change the project.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, tick Use my permission to override rules, re-tag resources with any visible project, regardless of current project relations.
7. Select any project to tag the drive.
8. Click Force change with admin privilege.

note

Forcefully tagging a drive with a project is only available to users with the Tag anything with any project permission.

Remove a Project from a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to remove the project from.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, select No project (unlocked) to remove the project tag from the drive.
7. Click Declassify.

note

If you have the Tag anything with any project permission, you can use the Force change with admin privilege option to forcibly remove a project tag, even from a project you do not belong to.

Confirmations, Errors & Solutions

Removed Project Successfully

Declassify drive-name completely (total-declassifying-time).

Share a Drive with Other Users

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to share.
4. Click the menu next to the selected drive in the left panel list.
5. Select Share.
6. In the prompt, click the Share with a user button in the top right corner.
7. In the pop-up, search with Filter by name or email…, then select the users to share the drive with.
8. Click Share with followed by the number of users.
9. Once done, click Close.

Result:

tiCrypt shows "Shared with" followed by the number of users, and "• N failed" if some shares failed. Each new user is listed with Read-only access.

info

• You can share a drive with any user, subject to your own sharing permissions. If the drive is tagged with a project, the recipient can use it only while their membership in that project is satisfied.
• Every new share is read-only. To let a user write to the drive, change their access to Full access afterwards. See Give Full-Access (Read-Write) of a Drive to a User.
• Share acts on one drive at a time.

The Share prompt lists the users who hold a key for the drive, newest first. Each row shows the user's name and email, the date the drive was shared with them, an access drop-down (Read-only or Full access), and a button to unshare. Use Filter by name or email… and Filter by access mode to narrow the list. If the drive is not shared with anyone, the prompt shows "This drive is not shared with anybody."

If you hold only a read-only key for the drive, the prompt explains that only users with read-write keys can add keys, and Share with a user is not offered.

Confirmations, Errors & Solutions

Shared Drive Successfully

Shared with total-number-of-users user(s).

No Users to Share in Drive Share Prompt

This drive cannot be shared.

Attach the Drive to a Virtual Machine

A drive gets its encryption key the first time it is attached to a virtual machine, when it is formatted. Until then there is no key to share, so a new drive cannot be shared. Attach the drive to a VM once; after that you can share it whether or not it is still attached.

Unable to Click Drive Share Button

Failed to look up keys for drive-name: Insufficient permissions to list drive keys for drive drive-string-id.

Ask Drive Owner(s) to Share the Drive

You must ask the drive owner(s) to share the drive with the user(s).

To Drive Owner
Only the drive owner, or a sub-admin or above, can look up the keys of a drive, so only they can open the Share prompt. Other users who hold a key for the drive cannot open it.

Give Full-Access (Read-Write) of a Drive to a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to give full-access to.
4. Click the Share button in the top panel.
5. In the prompt, select Full access from the drop-down next to the shared user(s).
6. Once done, click Close.

Result:

The user can now attach the drive read-write.

note

tiCrypt changes access by deleting the user's key and sharing the drive again with the new access. If that fails and the previous key cannot be restored either, the error ends with "and their previous key could not be restored, so they no longer have access". Share the drive with the user again.

Confirmations, Errors & Solutions

Change Own Share Status to Full Access

You cannot change your own access to this drive.

Ask the Drive Owner to Change Your Access

You cannot change the access of your own key. Ask the drive owner to change your access in the Share prompt.

Give Read-Only Access of a Drive to a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to give read-only access to.
4. Click the Share button in the top panel.
5. In the prompt, select Read-only from the drop-down next to the shared user(s).
6. Once done, click Close.

Result:

The user can attach the drive read-only only.

If the user co-owns a VM configuration that attaches this drive read-write, tiCrypt asks first. The Make a VM co-owner's key for this drive read-only? prompt lists each such user and configuration, marks the ones whose VM is running with "(VM running)", and explains: "They will no longer be able to use this drive read-write in those VMs. The owner of each VM will see a Repair prompt for the drive; repairing it re-shares the drive key with the co-owners." Click Make read-only to continue.

Confirmations, Errors & Solutions

Cannot Change Drive Owner Share Status to Read-Only

Failed to change user-name (owner)'s access: The drive owner's key may not be removed.

Transfer Drive Ownership Instead

The drive owner always has full access, and the owner's key cannot be removed, so the owner's access cannot be changed. To give the drive to another user, transfer ownership of the drive.

Change Own Share Status to Read-Only

You cannot change your own access to this drive.

Ask the Drive Owner to Change Your Access

You cannot change the access of your own key. Ask the drive owner to change your access in the Share prompt.

Edit Drive Details

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to edit.
4. Click the Edit drive button in the top panel list.
5. In the prompt, edit the drive name, team, backup settings, and other advanced options. The project and realm cannot be changed here.
6. Click Update followed by the drive name.

For the fields, restrictions, and messages of this prompt, see Edit Drive Details on the Drives Table page.

Migrate a Drive to a Different Storage Pool

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to migrate.
4. Click the Migrate drive button in the top panel list.
5. In the Migrate drive drive-name prompt, select the destination pool. Each pool is listed with its type and location.
6. Click Migrate.

Result:

The task Migrate drive-name runs, and the drive's state is Transferring until the migration ends.

Confirmations, Errors & Solutions

Migrated Drive Successfully

Migrate drive-name total-migration-time.

Failed to Migrate Drive

Migrate drive-name Failed at migration-failure-time: error-message.

Migrate Drive to a Different Migration Pool

The migration pool did not receive your drive. Ask the system administrator to review the migration pool and temporarily migrate the drive to a different migration pool.

Migration Button Inactive in Migrate Drive Prompt

The "Migrate" button in prompt is inactive for certain migration pools.

Select a Different Pool

The Migrate button stays inactive until you select a pool, and while the selected pool is the pool the drive is already in. Select a different pool.

Migration Request Timed Out

Migrate drive-name total-migration-time Failed at failure-time: the server took longer than 30s to reply.

View The Drive State in Drive Table

In the State column, review the drive status. If the drive is Transferring to an existing migration pool, the transfer process cannot be interrupted or redirected to another migration pool until completion.

Bulk Email Drive Owners

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive(s) whose owners you want to email.
4. Click the menu next to the selected drive in the left panel list.
5. Select Bulk email.
6. In the prompt, click Download to download the drive owner emails to your local machine.
7. Click Copy to copy the drive owner emails to your clipboard.
8. Once done, click Close.

Confirmations, Errors & Solutions

Copied Drive Email List Successfully

Email list copied to the clipboard.

Transfer Ownership of the Drive to a Different User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to transfer ownership.
4. Click the menu next to the selected drive in the left panel list.
5. Select Transfer ownership.
6. In the Transfer ownership of drive-name prompt, select the user in the New Owner field. Only users who hold Full access to the drive are offered.
7. Click Transfer ownership.

Result:

The task Change ownership of drive-name runs, and the selected user becomes the drive's owner.

info

To transfer drive ownership, you must first grant Full access to the drive to the user(s) you want to transfer ownership to.

Confirmations, Errors & Solutions

Transferred Drive Ownership Successfully

Change ownership of drive-name (total-transfer-time).

Unable to Transfer Drive Ownership to You from Drive Owner

The owner has not shared this drive read-write with anyone.

Ask the Drive Owner to Share the Drive with You in Read-Write

Ask the drive owner to share the drive with you in Full access (read-write) mode so that you can transfer ownership to yourself.

Unable to Transfer Drive Ownership to No Read-Write User

You have not shared the drive read-write with anyone.

Share the Drive Read-Write with At Least One User

Once you share the drive in Full access (read-write) mode with at least one user, you can transfer drive ownership to the shared user.

Unshare the Drive with a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to unshare with a user.
4. Click the Share button in the top panel.
5. In the prompt, filter the users by name or email.
6. Click the Delete button by the user you want to remove from sharing the drive with.
7. Once done, click Close.

Result:

tiCrypt shows "user-name no longer has access".

If the user co-owns a VM configuration that uses this drive, tiCrypt asks first. The Remove a VM co-owner's access to this drive? prompt lists each such user and configuration, marks the ones whose VM is running with "(VM running)", and explains that they will lose access to this drive in those VMs and that the owner of each VM will see a Repair prompt for the drive. Click Remove access to continue. If tiCrypt cannot check, it shows "Failed to check whether user-name co-owns VMs using this drive".

Confirmations, Errors & Solutions

Unshared Drive Successfully

user-name no longer has access.

Unable to Unshare Drive from Drive Owner

Failed to unshare file from user-name (owner): The drive owner's key may not be removed.

Ask the Drive Owner to Transfer Drive Ownership

The drive owner's key can never be removed. To take the drive away from its current owner, the owner must first transfer ownership to another user.

To Drive Owner
To transfer drive ownership to a different drive user, follow the steps in  

Transfer Ownership of the Drive to a Different User

Unshare the Drive with All Users

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to unshare from everyone else.
4. Click the menu next to the selected drive in the left panel list.
5. Select Unshare from everyone else.
6. In the Unshare drive-name from everyone else? prompt, review the users who will lose their key, then click Unshare.

Result:

Every key to the drive except yours is deleted. The users listed in the prompt can no longer use the drive.

note

• Only the drive owner can do this: anyone else gets "Only the owner of a drive may delete keys for it". The action is offered with the Unshare drives permission and acts on one drive at a time.
• If the drive is not shared with anyone else, tiCrypt shows "drive-name is not shared with anyone else".
• If some of those users co-own VM configurations that use the drive, the prompt also lists them and their configurations, as in Unshare the Drive with a User.

Confirmations, Errors & Solutions

Unshared Drive From Everyone Else

Unshare drive-name from everyone else total-unsharing-time.

Delete the Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to delete.
4. Click the menu next to the selected drive in the left panel list.
5. Select Delete.
6. In the prompt, tick the drive(s) without errors to delete.
7. Type "Confirm" to confirm deletion.
8. Click Delete followed by the number of drives, for example Delete 1 drive(s).

warning

"Deleting a drive is irreversible and the data will be lost." You cannot delete drives attached to a VM. Detach the drive from every VM first; you do not need to shut the VM down.

Result:

The drives are marked as deleted, and the task offers an Undo for 30 seconds before they are deleted permanently.

Confirmations, Errors & Solutions

Deleted Drive Successfully

Delete drive-name total-deletion-time.

Undo Drive Deletion Successfully

total-undone-deletion-time Undone Deleting drive-name.

Drive Currently Attached

Drive currently attached to a VM.

Detach the Drive

Detach the drive from every VM it is attached to, or ask the VM owner to detach it.

To VM Owner

To detach the drive, follow the steps in  

Detach a Drive from an Existing VM.

Failed to Enter Confirmation Text

Type "Confirm" in the text field below.

Enter Confirmation Text

The delete button stays inactive until you enter the word "Confirm" in the Type to Confirm field. Matching is case-sensitive.

Unable to Delete Drives

All drives have errors.

Manually Remove Drives from VMs

1. Open each VM the drives with errors are attached to.
2. Detach the drives with errors from those VMs.
3. Once done, verify the Drive currently attached to a VM error in the deletion drive prompt is cleared.
4. Proceed to drive deletion.