Seperate personal and work files on same machine?

crobe2 · 2014-06-22 16:19:32

Hey all,

hope this is the right subforum.

I am using my laptop for my personal stuff and some work things that can be done on the road like reading and writing documents.
The drive is encrypted and its allowed to keep those files on personal devices. There is no guidelines from the company regarding this and my machine is special anyway as its running Arch.

Recently I thought about possibilities to seperate personal and data from work. First thing I thought about are different user accounts, with switching virtual consoles and running seperate X-Sessions. A different approach is to install virtual machines for each activity, but as its a notebook power saving will be messed up and everything. Third approach is to install different systems.

Any ideas on this? Which approach do you take?

Robert

graysky · 2014-06-22 16:21:36

+1 for users.

Trilby · 2014-06-22 16:31:47

Separate users sounds like the best option out of those mentioned. But can you elaborate why you'd want/need to seperate these at all? What end goal/outcome is sought?

If you use the same editor, same configurations, same shell aliases, etc, then why have multiple user accounts?

In otherwords, before a method of separation is discussed, I think the reason for separation must be clear.

crobe2 · 2014-06-22 19:44:49

Trilby wrote:

In otherwords, before a method of separation is discussed, I think the reason for separation must be clear.

That is a valid objection. I think the reason is some additional security for the business data. That ranges from some people on a party accessing the device to change the music to catching a virus through some creepy wine program. Same reasons for that you normally use a dedicated device but cannot or do not want to in this case.

Trilby · 2014-06-22 19:56:00

Seperate user accounts would certainly prevent anyone at a party seeing/modifying work data - but it would do nothing to protect from a virus.

progandy · 2014-06-22 20:05:33

In your case I guess I'd use a mixed setup. First, you have your personal user account for private data. When you have to work, mount a encrypted partition for your business data. Then have a guest account you use for parties and restrict access to the minimum possible. Disable all automounting features, only allow access to $HOME, read only access to music and pictures, ...

dummyano · 2014-06-24 03:38:59

How about using a file based truecrypt volume? It's not mounted automatically, it's not accessible from external app when not mounted. Just be sure wine isn't running when you use it (wineserver -k)

Amanda S · 2014-06-24 05:12:48

dummyano wrote:

How about using a file based truecrypt volume? It's not mounted automatically, it's not accessible from external app when not mounted. Just be sure wine isn't running when you use it (wineserver -k)

Although the encrypted drive idea is good in SOME aspects, I don't see why someone would install wine in a computer used for work which contains sensitive data. Unless the work REALLY needs Wine, but I have my doubts about this. Depending on the sensitiveness of the data, using Wine is a risk most wouldn't take.
The guys at Wine say a virus in the program can theoretically do anything it would do on Windows. I'm not saying it's true, I'm also not saying it's false. I rather not take the risk. People either take those old tests are absolute true (which would be a terrible rookie mistake) or they can be skeptical and realize there is a possibility of such scenario to happen.

In case OP wants to use wine, he can keep the user policy strict, only a handful of trusted people knowing the user+wheel/encrypted drive password, and use a non-privileged account for regular stuff. This way only those few who know the wheel/root/encrypted drive passwords would be able to install things and affect the folder/drive containing the sensitive data.

Regarding TrueCrypt, personally I don't trust it. Instead, I use cryptsetup for all my encryption.

crobe2 wrote:

A different approach is to install virtual machines for each activity, but as its a notebook power saving will be messed up and everything.

Good, because if it wasn't then you'd have to trust the random number generator of the virtual machine.
Securing the Host is in most cases way better than securing a virtual machine, and most of the times when you add security you lose usability, you'll have to chose between them if the data you're trying to protect is very sensitive.

Last edited by Amanda S (2014-06-24 05:15:19)

crobe2 · 2014-06-24 18:25:52

Thanks for the thoughts, it is really interesting.

As for the "wine can access everything": That is true, because there is a drive Z: mapped to / ( not sure why the wine people do this), so basically any virus that is supported by wine [sic!] can access/modify/delete data the current user has write access to.

Arch Linux

#1 2014-06-22 16:19:32

Seperate personal and work files on same machine?

#2 2014-06-22 16:21:36

Re: Seperate personal and work files on same machine?

#3 2014-06-22 16:31:47

Re: Seperate personal and work files on same machine?

#4 2014-06-22 19:44:49

Re: Seperate personal and work files on same machine?

#5 2014-06-22 19:56:00

Re: Seperate personal and work files on same machine?

#6 2014-06-22 20:05:33

Re: Seperate personal and work files on same machine?

#7 2014-06-24 03:38:59

Re: Seperate personal and work files on same machine?

#8 2014-06-24 05:12:48

Re: Seperate personal and work files on same machine?

#9 2014-06-24 18:25:52

Re: Seperate personal and work files on same machine?

Board footer