tiCrypt 2.17.15

Share Drives

Sharing a drive grants another user access to that drive's encryption key. Sharing is not a filesystem permission that the server enforces on your behalf: because tiCrypt stores only ciphertext it cannot decrypt, the only way for someone else to read a drive is for them to hold a key for it. This is why sharing requires the View drive keys (necessary to share/attach) permission, and why the effect of sharing is different from what a shared folder does elsewhere.

Why sharing hands over a key

The server cannot grant access on your behalf. On a conventional system, an administrator can add someone to an access list and the filesystem enforces it. In tiCrypt the data at rest is opaque to the server, so access is granted by giving out a key rather than by editing a list. The practical consequence is that sharing is an act by the data owner, not by an administrator.

Revoking access stops future mounts, not past reads. Unsharing removes a user's ability to mount the drive from that point on. It cannot retract what they have already decrypted and read. Treat sharing as a disclosure decision, not a reversible toggle.

Co-owning a VM implies drive access. Adding a user as a co-owner of a VM configuration gives them access to that VM's drives, because co-owners need drive access to manage the machine. If you want a colleague to use a machine without reading everything on it, give them a lower VM role rather than co-ownership.

Project tags on a drive are a classification, not a label. Tagging a drive with a project records which regulatory regime its contents fall under, which is what makes the audit trail meaningful. Removing or forcing a project tag is a declassification action and requires the corresponding project-management permission.

Before you begin

• You have the Share drives and View drive keys (necessary to share/attach) permissions.
• The recipient is an active user. Project membership is not required to receive a share, but for a project-tagged drive the recipient can use the drive only while their membership in that project is satisfied.
• The drive is not attached to any VM if you are changing its project.

Add or Change a Project in a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to add or change the project.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, select a project to tag the drive.
7. Click Classify.

tip

Check your changes in the drive. The project tag name displays by the drive in the list or in the drive details under the drive owner name.

Confirmations, Errors & Solutions

Did Not Select Any Project

No change made.

Classified Project in Drive

Classify drive-name to project-name(total-classifying-time).

Failed to Classify Project in Drive

You cannot modify drive-name's project while it is attached to a VM.

Detach the Drive Before Changing Its Project

A drive's project cannot be changed while the drive is attached to any VM, read-write or read-only. Detach the drive from every VM it is attached to, then change the project.

To Virtual Machine Owner
To detach the drive, follow the steps in 

Detach a Drive from an Existing VM.

Forcefully Add or Change a Project in a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to add or change the project.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, tick Use my permission to override rules, re-tag resources with any visible project, regardless of current project relations.
7. Select any project to tag the drive.
8. Click Force change with admin privilege.

note

Forcefully tagging a drive with a project is only available to users with the Arbitrarily tag resources with any project permission.

Remove a Project from a Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to remove the project from.
4. Click the menu in the top right corner of the drive's details panel.
5. Select Change project.
6. In the pop-up, select No project (unlocked) to remove the project tag from the drive.
7. Click Declassify.

note

If you have the Arbitrarily tag resources with any project permission, you can use the Force change with admin privilege option to forcibly remove a project tag, even from a project you do not belong to.

Confirmations, Errors & Solutions

Removed Project Successfully

Declassify drive-name completely (total-declassifying-time).

Share a Drive with Other Users

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to share.
4. Click the menu next to the selected drive in the left panel list.
5. Select Share.
6. In the prompt, click the Share with a user button in the top right corner.
7. In the pop-up, enter and select the user names to share the drive with.
8. Click Share.
9. Once done, click Close.

info

You can share a drive with any user, subject to your own sharing permissions. If the drive is tagged with a project, the recipient can use it only while their membership in that project is satisfied.

Confirmations, Errors & Solutions

Shared Drive Successfully

Shared with total-number-of-users user(s).

No Users to Share in Drive Share Prompt

This drive cannot be shared.

Attach the Drive to a Virtual Machine

The drive must be initialized and attached to a virtual machine before it can be shared.

Unable to Click Drive Share Button

Failed to look up keys for drive-name: Insufficient permissions to list drive keys for drive drive-string-id.

Ask Drive Owner(s) to Share the Drive

You must ask the drive owner(s) to share the drive with the user(s).

To Drive Owner
Only the drive owner, or a sub-admin or above, can look up the keys of a drive, so only they can open the Share prompt. Other users who hold a key for the drive cannot open it.

Give Full-Access (Read-Write) of a Drive to a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to give full-access to.
4. Click the Share button in the top panel.
5. In the prompt, select Full access from the drop-down next to the shared user(s).
6. Once done, click Close.

Confirmations, Errors & Solutions

Change Own Share Status to Full Access

You cannot change your own access to this drive.

Ask the Drive Owner to Change Your Access

You cannot change the access of your own key. Ask the drive owner to change your access in the Share prompt.

Give Read-Only Access of a Drive to a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to give read-only access to.
4. Click the Share button in the top panel.
5. In the prompt, select Read-only from the drop-down next to the shared user(s).
6. Once done, click Close.

Confirmations, Errors & Solutions

Cannot Change Drive Owner Share Status to Read-Only

Failed to change user-name (owner)'s access: The drive owner's key may not be removed.

Transfer Drive Ownership Instead

The drive owner always has full access, and the owner's key cannot be removed, so the owner's access cannot be changed. To give the drive to another user, transfer ownership of the drive.

Change Own Share Status to Read-Only

You cannot change your own access to this drive.

Ask the Drive Owner to Change Your Access

You cannot change the access of your own key. Ask the drive owner to change your access in the Share prompt.

Edit Drive Details

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to edit.
4. Click the Edit drive button in the top panel list.
5. In the prompt, edit the drive name, team, backup settings, and other advanced options. The project and realm cannot be changed here.
6. Click Update followed by the drive name.

Migrate a Drive to a Different Storage Pool

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to migrate.
4. Click the Migrate drive button in the top panel list.
5. In the prompt, select the destination pool.
6. Click Migrate.

Confirmations, Errors & Solutions

Migrated Drive Successfully

Migrate drive-name total-migration-time.

Failed to Migrate Drive

Migrate drive-name Failed at migration-failure-time: error-message.

Migrate Drive to a Different Migration Pool

The migration pool did not receive your drive. Ask the system administrator to review the migration pool and temporarily migrate the drive to a different migration pool.

Migration Button Inactive in Migrate Drive Prompt

The "Migrate" button in prompt is inactive for certain migration pools.

Select a Different Pool

The Migrate button stays inactive until you select a pool, and while the selected pool is the pool the drive is already in. Select a different pool.

Migration Request Timed Out

Migrate drive-name total-migration-time Failed at failure-time: the server took longer than 30s to reply.

View The Drive State in Drive Table

In the State column, review the drive status. If the drive is Transferring to an existing migration pool, the transfer process cannot be interrupted or redirected to another migration pool until completion.

Bulk Email Drive Owners

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive(s) whose owners you want to email.
4. Click the menu next to the selected drive in the left panel list.
5. Select Bulk email.
6. In the prompt, click Download to download the drive owner emails to your local machine.
7. Click Copy to copy the drive owner emails to your clipboard.
8. Once done, click Close.

Confirmations, Errors & Solutions

Copied Drive Email List Successfully

Email list copied to the clipboard.

Transfer Ownership of the Drive to a Different User

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to transfer ownership.
4. Click the menu next to the selected drive in the left panel list.
5. Select Transfer ownership.
6. In the prompt, enter the new drive owner name.
7. Click Transfer ownership.

info

To transfer drive ownership, you must first grant Full access to the drive to the user(s) you want to transfer ownership to.

Confirmations, Errors & Solutions

Transferred Drive Ownership Successfully

Change ownership of drive-name (total-transfer-time).

Unable to Transfer Drive Ownership to You from Drive Owner

The owner has not shared this drive read-write with anyone.

Ask the Drive Owner to Share the Drive with You in Read-Write

Ask the drive owner to share the drive with you in Full access (read-write) mode so that you can transfer ownership to yourself.

Unable to Transfer Drive Ownership to No Read-Write User

You have not shared the drive read-write with anyone.

Share the Drive Read-Write with At Least One User

Once you share the drive in Full access (read-write) mode with at least one user, you can transfer drive ownership to the shared user.

Unshare the Drive with a User

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to unshare with a user.
4. Click the Share button in the top panel.
5. In the prompt, filter the users by name or email.
6. Click the Delete button by the user you want to remove from sharing the drive with.
7. Once done, click Close.

Confirmations, Errors & Solutions

Unshared Drive Successfully

user-name no longer has access.

Unable to Unshare Drive from Drive Owner

Failed to unshare file from user-name (owner): The drive owner's key may not be removed.

Ask the Drive Owner to Transfer Drive Ownership

The drive owner's key can never be removed. To take the drive away from its current owner, the owner must first transfer ownership to another user.

To Drive Owner
To transfer drive ownership to a different drive user, follow the steps in  

Transfer Ownership of the Drive to a Different User

Unshare the Drive with All Users

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to unshare from everyone else.
4. Click the menu next to the selected drive in the left panel list.
5. Select Unshare from everyone else.

Confirmations, Errors & Solutions

Unshared Drive From Everyone Else

Unshare drive-name from everyone else total-unsharing-time.

Delete the Drive

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Select the drive to delete.
4. Click the menu next to the selected drive in the left panel list.
5. Select Delete.
6. In the prompt, tick the drive(s) without errors to delete.
7. Type "Confirm" to confirm deletion.
8. Click Delete followed by the number of drives, for example Delete 1 drive(s).

warning

You cannot delete drives actively attached to VMs. Shut down the VM first, then delete the drive.

Confirmations, Errors & Solutions

Deleted Drive Successfully

Delete drive-name total-deletion-time.

Undo Drive Deletion Successfully

total-undone-deletion-time Undone Deleting drive-name.

Drive Currently Attached

Drive currently attached to a VM.

Shut Down the VM

Shut down the VM, or ask the VM owner to shut it down.

To VM Owner

To shut down the VM, follow the steps in  

Shut Down a Virtual Machine.

Failed to Enter Confirmation Text

Type "Confirm" in the text field below.

Enter Confirmation Text

The delete button stays inactive until you enter the word "Confirm" in the Type to Confirm field. Matching is case-sensitive.

Unable to Delete Drives

All drives have errors.

Manually Remove Drives from VMs

1. Shut down all existing VMs where the drives with errors are located.
2. Open each VM separately, then remove the drives with errors.
3. Once done, verify the Drive currently attached to a VM error in the deletion drive prompt is cleared.
4. Proceed to drive deletion.