PGP NetShare Command Line 10.2 Operating instructions

Type
Operating instructions
PGP™ NetShare Command Line
User's Guide
10.2
The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement.
Version 10.2.0. Last updated: July 2011.
Legal Notice
Copyright (c) 2011 Symantec Corporation. All rights reserved.
Symantec, the Symantec Logo, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its
affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering.
No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if
any.
THE DOCUMENTATION IS PROVIDED"AS IS"AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING
ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT
TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR
INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION.
THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights
as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. “Commercial Computer
Software and Commercial Computer Software Documentation”, as applicable, and any successor regulations. Any use, modification, reproduction
release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with
the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
Symantec Home Page (
http://www.symantec.com)
Printed in the
United States of America.
10 9 8 7 6 5 4 3 2 1
Contents
Introduction 3
About PGP NetShare 3
About PGP NetShare Command Line 3
Audience 4
System Requirements 4
Installing and Uninstalling 4
Upgrading to Version 10.1 or Above 4
Working with Group Keys 5
About Group Keys 5
Using Group Keys 5
Technical Support 6
Contacting Technical Support 6
Licensing and registration 7
Customer service 7
Support agreement resources 7
The Command-Line Interface 9
Overview 9
Scripting 10
Editing the Path on a System 10
Configuration File 11
Environment Variables 12
Creating Environment Variables 12
Passphrases 13
XML Output 14
Searching for Keys on Remote Servers 14
Commands 15
--version 16
--help (-h) 17
--encrypt (-e) 17
--decrypt 19
--reencrypt (-r) 21
--reencrypt-full 22
--reencrypt-delta 24
--reencrypt-clone 26
--list (-l) 27
--list-xml 27
--verify (-v) 28
--lock-all 29
--unlock 29
--set-driver 30
--get-driver 31
ii Contents
Options 33
--recipient (-r) 34
--recipient-owner 35
--recipient-operator 35
--recipient-remove 35
--recipient-xml 35
--group (-g) 36
--group-operator 36
--signer (s) 36
--signer-passphrase 37
--signer-passphrase-fd 37
--passphrase (-p) 37
--passphrase-fd 37
--adk 38
--public-keyring 38
--private-keyring 38
--universal-server 39
--auth-username 39
--auth-passphrase 39
--auth-passphrase-fd 40
--input (-i) 40
--output (-o) 40
--output-file 40
--home-dir 41
Flags 43
--verbose 43
--remote 44
--force 44
--halt-on-error 44
--local-mode 44
--preserve 45
--quiet 45
Quick Reference 47
Commands 47
Options 47
Flags 48
Automated Copying 49
Copying in Standalone Mode 49
Copying in Desktop Mode 49
This User's Guide tells you how to use the PGP NetShare Command Line application.
In This Chapter
About PGP NetShare....................................................................................................... 3
About PGP NetShare Command Line ........................................................................... 3
Audience ...........................................................................................................................4
System Requir
ements..................................................................................................... 4
Installing and Uninstalling............................................................................................ 4
Upgrading to Version 10.1 or Above ............................................................................ 4
Working with Group Keys..............................................................................................5
Technical Support ........................................................................................................... 6
About PGP NetShare
PGP NetShare is a software product that lets a defined set of users access files in a
shared, protected space (such as on a corporate file server, in a shared folder, or even
removable media such as a thumb drive).
The files are protected by encryption, but continue to appear (to the users who have
access rights) as normal application files. Anyone without access rights to the files, but
who can access the shared space, can see the files but does not have access to the
content.
PGP NetShare can be purchased as a standalone product, as one product among several
products for example, PGP Desktop Email or PGP Whole Disk Encryption), or as part of
PGP Desktop.
For more information about PGP NetShare, see the:
PGP Desktop User's Guide
PGP NetShare Quick Start Guide
PGP NetShare Data Sheet
About PGP NetShare Command Line
PGP NetShare Command Line gives you access to PGP NetShare functionality using a
command-line interface.
1
Introduction
4 Introduction
Audience
Accessing PGP NetShare Command Line functions from the command line is useful for
scripting PGP NetShare functions, troubleshooting problems, or if the graphical user
interface is not available.
Note: Not all PGP NetShare functions are available via the command line.
PGP NetShare Command Line is always in one of two operation modes:
desktop. PGP Desktop is also installed on the system.
standalone. PGP Desktop is not installed on the same system.
Run the --version command to see what operation mode PGP NetShare Command
Line is in.
When you run the --help command, only those commands, options, and flags that are
available in the current operation mode are displayed.
Audience
This User's Guide is for anyone who is going to be using PGP NetShare Command Line
to perform PGP NetShare functions from the command line.
It assumes you are familiar with using PGP NetShare via the graphical user interface in
the standalone product or as part of PGP Desktop.
System Requirements
The system requirements for PGP NetShare Command Line are the same as for PGP
NetShare itself; if PGP NetShare (standalone or as part of PGP Desktop) installs on a
system, PGP NetShare Command Line (pgpnetshare.exe) will also install and be usable.
Installing and Uninstalling
PGP NetShare Command Line (pgpnetshare.exe) is installed automatically when PGP
NetShare is installed on a system.
The default location for either installation is: C:\Program Files\PGP
Corporation\PGP Desktop\pgpnetshare.exe.
To uninstall PGP NetShare Command Line, simply uninstall PGP NetShare or PGP
Desktop.
Upgrading to Version 10.1 or Above
Changes were made to PGP NetShare Command Line in Version 10.1, resulting in some
commands, options, and flags from previous versions being removed.
Introduction
Working with Group Keys
5
If you scripted previous versions of PGP NetShare Command Line, make sure to check
your scripts to ensure that they do not reference commands, options, or flags that are
no longer in the product.
Working with Group Keys
Starting with PGP Universal Server 3.2 and PGP NetShare Command Line 10.2, your
PGP Universal Server administrator can create group keys that you can use with PGP
NetShare Command Line.
Note: Group keys are different than using Active Directory groups. Using a group key
adds only the single key to a protected folder. Using an Active Directory group adds
every key found for members of that group.
About Group Keys
The group key is intended to be used as a single key to encrypt or decrypt PGP
NetShare-protected files and folders.
The group key can be created by PGP Universal Server administrators only. Intended to
be used with active synchronization with Active Directory, the group key reduces the
overhead associated with encrypting a file/folder to a large number of keys. Your PGP
Universal Server administrator can map file server access/encryption policies to Active
Directory security groups.
Note: For detailed information about creating group keys, refer to the PGP Universal
Server Administrator's Guide or contact your PGP Universal Server administrator.
When a member of the group associated with the group key leaves your organization or
no longer requires access to protected folders, you should re-encrypt your folders to
ensure access is denied to that member.
Using Group Keys
To use group keys with PGP NetShare Command Line:
To encrypt or re-encrypt using the public portion of a group key, specify it on the
command line when using the --recipient command.
To unlock, re-encrypt, or decrypt using the private portion of a group key in a PGP
Universal Server-managed environment, authenticated access to the PGP
Universal Server managing the desired group key is required. Under these
circumstances PGP NetShare Command Line will automatically use the enrolled
user's information to authenticate.
To unlock, re-encrypt, or decrypt using the private portion of a group key in a
standalone environment, you must specify the PGP Universal Server managing
the desired group key, the user and the user's passphrase on the command line in
order to access the private portion of the group key.
6 Introduction
Technical Support
Technical Support
Symantec Technical Support maintains support centers globally. Technical Support’s
primary role is to respond to specific queries about product features and functionality.
The Technical Support group also creates content for our online Knowledge Base. The
Technical Support group works collaboratively with the other functional areas within
Symantec to answer your questions in a timely fashion. For example, the Technical
Support group works with Product Engineering and Symantec Security Response to
provide alerting services and virus definition updates.
Symantec’s support offerings include the following:
A range of support options that give you the flexibility to select the right amount
of service for any size organization
Telephone and/or Web-based support that provides rapid response and up-to-the-
minute information
Upgrade assurance that delivers software upgrades
Global support purchased on a regional business hours or 24 hours a day, 7 days a
week basis
Premium service offerings that include Account Management Services
For information about Symantec’s support offerings, you can visit our Web site at the
following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement and
the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
www.symantec.com/business/support/
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be at the
computer on which the problem occurred, in case it is necessary to replicate the
problem.
When you contact Technical Support, please have the following information available:
Product release level
Hardware information
Available memory, disk space, and NIC information
Operating system
Version and patch level
Network topology
Router, gateway, and IP address information
Introduction
Technical Support
7
Problem description:
Error messages and log files
Troubleshooting that was performed before contacting Symantec
Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registration or a license key, access our technical
support Web page at the following URL:
www.symantec.com/business/support/
Customer service
Customer service information is available at the following URL:
www.symantec.com/business/support/
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
Questions regarding product licensing or serialization
Product registration updates, such as address or name changes
General product information (features, language availability, local dealers)
Latest information about product updates and upgrades
Information about upgrade assurance and support contracts
Information about the Symantec Buying Programs
Advice about Symantec's technical support options
Nontechnical presales questions
Issues that are related to CD-ROMs or manuals
Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
Asia-Pacific and Japan [email protected]
Europe, Middle-East, Africa [email protected]
North America, Latin America [email protected]
This section describes the command-line interface of PGP NetShare Command Line.
In This Chapter
Overview ...........................................................................................................................9
Scripting .........................................................................................................................10
Editing the Path on a System.......................................................................................10
Configuration File .........................................................................................................11
Environment Variables.................................................................................................12
Passphrases....................................................................................................................13
XML Output ....................................................................................................................14
Searching for Keys on Remote Servers......................................................................14
Overview
PGP NetShare Command Line uses a command-line interface. You enter a valid
command at the command prompt and press Enter. PGP NetShare Command Line
responds appropriately based on what you entered (if you entered a valid command) or
with an error message (if you entered an invalid or incorrectly structured command).
All PGP NetShare Command Line commands have a long form: the text "pgpnetshare", a
space, two hyphens "--", and then the command name.
For example:
C:\>pgpnetshare --help [Enter]
is the command to display the built-in help information.
(The command prompt, C:\>, and [Enter] will no longer be shown in examples.)
A few commands also have a short form: one hyphen and then a single letter that
substitutes for the command name. For example:
pgpnetshare -h
is the short form of the command to access help.
Short forms of commands are noted where appropriate.
2
The Command-Line Interface
10 The Command-Line Interface
Scripting
Scripting
PGP NetShare Command Line commands can easily be inserted into scripts for
automating common tasks, such as creating a Protected Folder, re-encrypting a
Protected Folder, or verifying files and folders in a Protected Folder.
PGP NetShare Command Line commands can easily be added to scripts written with
scripting languages such as Perl or Python.
Editing the Path on a System
By default, the PGP NetShare Command Line application, pgpnetshare.exe, is installed
in C:\Program Files\PGP Corporation\PGP Desktop\.
To use PGP NetShare Command Line using the Windows Command Prompt application,
you need to navigate to the PGP NetShare Command Line directory to execute
commands (or the commands will fail).
If you wish to be able to execute PGP NetShare Command Line commands from any
location when using Windows Command Prompt, you need to change the path on the
system to include the location of the PGP NetShare Command Line application.
To add the PGP NetShare Command Line application to your path on a Windows 7 or
Vista system:
1 On the Windows desktop, right click the Computer icon, then select Properties.
2 On the left side of the System Control Panel screen, click Advanced System
Settings.
3 If you are prompted for permission to continue, click Continue.
4 At the bottom of the System Properties screen, click Environment Variables.
5 In the System Variables section at the bottom of the Environment Variables
screen, select Path, then click Edit.
6 At the end of the existing Variable value line, enter a semicolon (;), then add the
path to the PGP NetShare Command Line application
7 Click OK to save the change, then close the windows you opened.
To add the PGP NetShare Command Line application to your path on a Windows XP or
2000 system:
1 On the Windows desktop, right click the My Computer icon, then select
Properties.
2 On the System Properties dialog, click the Advanced tab.
3 At the bottom of the Advanced tab, click Environment Variables.
4 In the System Variables section at the bottom of the Environment Variables
screen, select Path, then click Edit.
5 At the end of the existing Variable value line, enter a semicolon (;), then add the
path to the PGP NetShare Command Line application.
The Command-Line Interface
Configuration File
11
6 Click OK to save the change, then close the windows you opened.
Configuration File
The PGP NetShare Command Line configuration file holds settings that affect how PGP
NetShare Command Line works.
The PGP NetShare Command Line configuration file (PGPprefs.xml) cannot be changed
by PGP NetShare Command Line itself: any changes need to be edited manually.
The PGP NetShare Command Line configuration file is located:
Windows XP: C:\Documents and Settings\[Local User]\Application Data\PGP
Corporation\PGP\.
Windows 7 and Vista: C:\Users\[Local User]\AppData\Roaming\PGP
Corporation\PGP\.
Note: Configuration file settings in PGPprefs.xml are shared among all PGP
Corporation applications on the system.
Configuration file settings you can use with PGP NetShare Command Line are:
Output File (CLoutputFile). Specifies the output file (default is not set in the
configuration file; defaults to stdout). The output file is used for output messages.
See --output-file for more information.
Private keyring file (privateKeyringFile). The filename or path and filename
to the private keyring file. The default is secring.skr, located in the default PGP
NetShare Command Line home directory. See --private-keyring for more
information.
Public keyring file (publicKeyringFile). The filename or path and filename to
the public keyring file. The default is pubring.pkr, located in the default PGP
NetShare Command Line home directory. See --public-keyring for more
information.
Keyservers (keyservers). Specifies the keyserver(s) to be searched for keys.
Always encrypt to keys (alwaysEncryptToKeys). Specifies keys that should
always be added implicitly when encrypting and re-encrypting.
Configured Universal Server (adminGroupServer). Specifies the PGP Universal
Server used for activity logging, key and Active Directory group queries. Only
available in configured installs with PGP Desktop.
Enrollment Cookie (adminConfigCookie). Authenticates the user against a PGP
Universal Server for an operation. Only available in configured installs with PGP
Desktop.
Location Blacklist (blackListContent, enableBlackList). Entries in the
Blacklist specify those locations that should never be encrypted by PGP NetShare
Command Line.
Organization ADK (ADKKeyID, useADK). Specifies the centralized organization
ADK (Additional Decryption Key). Usually only available in configured installs
with PGP Desktop.
12 The Command-Line Interface
Environment Variables
Policy ADK (policyADK, usePolicyADK). Specifies a policy-specific ADK.
Usually only available in configured installs with PGP Desktop.
Manage Individual Files (allowAdvancedUserMode). Controls whether the user
is allowed to manage (encrypt, decrypt, or re-encrypt) single files, as opposed to
folders that might contain files.
Environment Variables
PGP NetShare Command Line behavior can be changed using environment variables.
Environment variables have the lowest priority compared to the command line and the
configuration file. Settings for either will override environment variables. However, if a
value for an item is not specified on the command line or in the configuration file, the
environment variable will be used. Environment variables cannot be disabled; if they
are present, they are implemented. To disable an environment variable, remove it.
Setting a Boolean environment variable will activate it, regardless of the value to which
it is set.
Environment variables that can be implemented for PGP NetShare Command Line are:
PGP_LOCAL_MODE. This is a Boolean environment variable that forces PGP
NetShare Command Line to run in local mode. The default is unset. See --local-
mode for more information.
Usage: PGP_LOCAL_MODE=1
PGP_HOME_DIR. This is a string environment variable that overrides the default
home directory, pointing it to the path supplied in the variable. The default is
unset. See --home-dir for more information.
Usage: PGP_HOME_DIR=C:\Documents and Settings\<current
user>\Application Data\PGP Corporation\PGP\
PGP_PASSPHRASE. This is a string environment variable that lets you set your
passphrase. The default is unset. See --passphrase for more information.
Usage: PGP_PASSPHRASE="1Killer*Whale"
Creating Environment Variables
PGP NetShare Command Line lets you create environment variables to control certain
behaviors.
To create an environment variable on a Windows 7 system:
1 Right click the Computer icon on your desktop and choose Properties.
2 On the System window, click on Advanced system settings in the left pane.
3 On the System Properties window, select the Advanced tab and then click on
Environment Variables near the bottom of the window.
4 In the User Variables section of the Environment Variables screen, click New.
5 In the Variable name field, enter a name for the variable you are creating.
The Command-Line Interface
Passphrases
13
For example, if you were setting the PGP_HOME_DIR environment variable, you
would enter:
PGP_HOME_DIR
6 In the Variable value field, enter a value appropriate for the variable you are
creating.
For example, if you were setting the PGP_HOME_DIR environment variable, you
could enter:
C:\PGP\PGPhomedir\
7 Click OK.
The Environment Variables screen reappears. The environment variable you
created displays in the User variables list.
8 Click OK.
9 On the System Properties window, click Apply then click OK.
10 Close the System window.
Passphrases
For consistency, all example passphrases in this guide are shown in single quotation
marks ('). Putting passphrases between single quotation marks ensures that reserved
characters and spaces are interpreted correctly when entered on the command line.
If you do not use any reserved characters or spaces in your passphrases, then you do
not have to enclose them in single quotation marks.
On Windows systems, if you have a space in a passphrase, you must enclose the
passphrase in single or double quotation marks when you enter it on the command line.
Also, double quotation marks (") as part of the passphrase must be escaped with a
preceding double quotation mark.
For example, if you want to use
Thomas "Stonewall" Jackson
as your passphrase, you would have to enter it as
'Thomas ""Stonewall"" Jackson'
on the command line. You need the quotation marks at the beginning and end for the
spaces and you need to escape each double quotation mark used in the passphrase with
another double quotation mark.
Note: If you are having problems entering certain characters in your passphrases,
check the information about how to handle reserved characters for the operating
system or shell interpreter you are using.
14 The Command-Line Interface
XML Output
XML Output
PGP NetShare Command Line gives you the option to save some output in XML format.
If you desire properly formatted XML output, do not copy the XML output from the
console window and then paste it; this could introduce extraneous newline characters
into the output.
Instead, use either of these two methods:
Use the --output-file option.
pgpnetshare --list-xml <XMLcontent> output-file
'c:\acllist-xml'
Pipe the output directly to a file:
pgpnetshare --list-xml <XMLcontent> > 'c:\acllist-xml'
Searching for Keys on Remote Servers
By default, PGP NetShare Command Line searches for keys on the local system.
If you want PGP NetShare Command Line to search for keys on a remote keyserver, a
PGP Universal Server for example, you must explicitly tell it to search there.
There are two commands to search for keys on a remote keyserver:
--universal-server searches for keys on the specified PGP Universal Server.
--remote searches for keys on the specified keyserver.
This section describes PGP NetShare Command Line commands:
--version, which displays PGP NetShare Command Line version information.
--help, which provides a brief description of the commands and options available
in PGP NetShare Command Line.
--encrypt, which creates a Protected Folder and specifies who can access the
files.
--decrypt, which decrypts an existing Protected Folder and the files in it.
--reencrypt, which modifies who can access files in a Protected Folder.
--reencrypt-full, which modifies who can access files in a Protected Folder
and reencrypts the files.
--reencrypt-delta, which reencrypts files and folders in delta mode.
--reencrypt-clone, which reencrypts files and folders in clone mode.
--list, which lists the file or folder access control list (ACL).
--list-xml, which lists the file or folder ACL in XML format.
--verify, which displays information about the specified protected file or
directory.
--lock-all, which clears symmetric keys cached by PGP NetShare Command
Line
--unlock, which unlocks a file or folder.
--set-driver, which sets the state of the PGP NetShare Command Line driver,
active or passive.
--get-driver, which displays the current state of the PGP NetShare Command
Line driver, active or passive.
3
Commands
16 Commands
--version
In This Chapter
--version..........................................................................................................................16
--help (-h) ........................................................................................................................17
--encrypt (-e)...................................................................................................................17
--decrypt .........................................................................................................................19
--reencrypt (-r) ...............................................................................................................21
--reencrypt-full ..............................................................................................................22
--reencrypt-delta ...........................................................................................................24
--reencrypt-clone...........................................................................................................26
--list (-l) ...........................................................................................................................27
--list-xml .........................................................................................................................27
--verify (-v)......................................................................................................................28
--lock-all..........................................................................................................................29
--unlock ...........................................................................................................................29
--set-driver......................................................................................................................30
--get-driver .....................................................................................................................30
--version
The --version command displays information about the version of PGP NetShare
Command Line you are using, including the current operation mode: desktop or
standalone.
The usage format is:
pgpnetshare --version [options]
Where:
[options] let you modify the command. Options are:
--verbose, which displays additional information about the operation.
Examples:
pgpnetshare --version
PGP NetShare Command Line responds with version information in the format:
PGP NetShare Command Line version 10.2.0 (Build 999),
mode(desktop)
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53

PGP NetShare Command Line 10.2 Operating instructions

Type
Operating instructions

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI