box_l Posted February 5, 2009 Posted February 5, 2009 hi, i am trying to get truecrypt traveller to run for my teachers (non-admin). the problem is that it will not load the driver for a non admin. my idea is autorun.inf calls a vbs that uses runas to elevate the application. however, i cannot seem to get this bit right WshShell.Run "runas /user:adminequivalent "TrueCrypt\TrueCrypt.exe /q background /e /m rm /v Confidential.tc"" where do my quotes/chr(34)s go? or does anyone have a better idea? TIA BoX
DrPerceptron Posted February 5, 2009 Posted February 5, 2009 WshShell.Run "runas /user:adminequivalent " & chr(34) & "TrueCrypt\TrueCrypt.exe /q background /e /m rm /v Confidential.tc" & chr(34) & "" I think... 1
PiqueABoo Posted February 5, 2009 Posted February 5, 2009 Out of interest why can't you just install truecrypt on these machines where they're not an admin?
box_l Posted February 5, 2009 Author Posted February 5, 2009 @piqueaboo because the traveller mode uses (tries to) its own driver and does not use the one already installed. frustrating huh! @drperceptron thank you, but it looks like i need 2 more quotes. this works at the cmd prompt Q:\>runas /user:adminequivalent "TrueCrypt.exe /q background /e /m rm /v Confidential.tc" BoX
ajbritton Posted February 5, 2009 Posted February 5, 2009 Surely for this to work you will have to give out the passwords for the adminequivalent local user accounts. Have you looked at this: Rohos Mini Drive
Quackers Posted February 5, 2009 Posted February 5, 2009 There is a security policy that allows non administrators to install drivers in group policy.
box_l Posted February 5, 2009 Author Posted February 5, 2009 no. i shall use wshsendkeys and the encrypt the vbs file so it cannot be read i know that encrypted vbs (vbe) can be decrypted but it would only give them a local admin to the laptop/pc which will be fully encrypted and in accessible anyway. rohos is great and free but only gives 1Gb in the free vesion i have one with the head teacher already for testing. it gets horrible if the drive is not dismounted properly too. thats not to say truecrypt ones will not, they probably will. but teachers being who they are they, i dont expect them to get it right all the time and i dont want to have to deal with lots of buggered up drives with lost files. box @quackers thank-you i'll have a look tomorrow
box_l Posted February 6, 2009 Author Posted February 6, 2009 dr perceptron, your code was correct. it special characters in my password in the wsh.sendkeys that was making it fail. it was just so hard to see what was happening in the cmd window after the password was entered. thanks applied to you origional post. BoX
Arthur Posted February 8, 2009 Posted February 8, 2009 As mentioned above the best way to do this would be to install TrueCrypt along with the driver it needs so that even restricted users can mount encrypted volumes. If you would like a copy of the package I created that does this just let me know.
box_l Posted February 9, 2009 Author Posted February 9, 2009 yes please! does it get the traveller mode for the usb stick working? BoX
Geoff Posted February 9, 2009 Posted February 9, 2009 Encoded VBS scripts are not secure. VBE decoder - Decode all files encoded (original version) with screnc.exe
box_l Posted February 9, 2009 Author Posted February 9, 2009 Hi Geoff, I know they are only obfuscated really, but as i posted above i know that encrypted vbs (vbe) can be decrypted but it would only give them a local admin to the laptop/pc which will be fully encrypted and in accessible anyway. they might get a local admin passord but they will not get past the truecrypt boot password on the laptop. any better ideas than this? BoX
Geoff Posted February 9, 2009 Posted February 9, 2009 Why do you need to use Traveller mode? Why don't you just pre-install TrueCrypt on these machines and just avoid the whole issue? they might get a local admin passord but they will not get past the truecrypt boot password on the laptop. No but they could install a keylogger
ZeroHour Posted February 9, 2009 Posted February 9, 2009 One other way to do it for future reference is using AUTOIT. It has a function built in for runas another account and if you secure the exe it should be harder to sniff the details where as if I kid finds that script he has the account password.
box_l Posted February 9, 2009 Author Posted February 9, 2009 @Geoff traveller mode so that they can use it on their home pc. not have to install trucrypt on their own machine. @zerohour i'll have a look at autoit cheers still need to look at the group policy load driver permission thing cheers everyone
ZeroHour Posted February 9, 2009 Posted February 9, 2009 Here is the code for autoit:RunAsSet('{USER}', '{DOMAIN}', '{PASSWORD}',{Load profile 1=yes 0=no}) RunWait('{PATH TO EXE WITH SWITCHES}') Exit 1
Arthur Posted February 9, 2009 Posted February 9, 2009 yes please! Does it get the traveller mode for the USB stick working? BoX The CC3 package I created for TrueCrypt v6.1a can be downloaded from here. The best bit is that if you use all the files I included in the 'Traveller Disk' folder within the package folder on your USB flash drives, TrueCrypt will work for both restricted users at school (because the driver has already been installed as part of the package) and on staff home computers too (since TrueCrypt can also run directly from the USB flash drive). The AutoIt script I created to do this is also shown below. Mount.au3 #NoTrayIcon #AutoIt3Wrapper_icon=TrueCrypt\Icon.ico #AutoIt3Wrapper_Compression=4 #AutoIt3Wrapper_Res_SaveSource=y $tc_hdd = '"' & @ProgramFilesDir & "\TrueCrypt\TrueCrypt.exe" & '"' $tc_usb = '"' & @ScriptDir & "\TrueCrypt\TrueCrypt.exe" & '"' $tc_switches = " /q background /cache y /history n /mountoption removable /explore /beep /v " $tc_volume = @ScriptDir & "\Encrypted.tc" If FileExists($tc_hdd) Then Run(@Comspec & ' /c ' & $tc_hdd & $tc_switches & $tc_volume, "", @SW_HIDE) Else Run(@Comspec & ' /c ' & $tc_usb & $tc_switches & $tc_volume, "", @SW_HIDE) EndIf Autorun.inf [Autorun] label=Encrypted Volume icon=TrueCrypt\TrueCrypt.exe,1 action=Mount TrueCrypt Volume open=Mount.exe shell=Item1 shell\Item1=&Mount TrueCrypt Volume shell\Item1\command=Mount.exe shell\Item2=&Unmount TrueCrypt Volume shell\Item2\command=TrueCrypt\TrueCrypt.exe /dismount /quit /silent /wipecache /beep shell\Item3=&Run TrueCrypt shell\Item3\command=TrueCrypt\TrueCrypt.exe shell\Item4=&Read Me shell\Item4\command=notepad.exe Readme.txt N.B. I have only tested this package on computers running Windows XP Pro SP2 since our CC3 network is XP only at the moment. I've included the Advanced Installer project file too, just in case you want to have a look at how I created the package or need to modify it to work on Windows Vista and 64-bit versions of Windows. 2
PiqueABoo Posted February 9, 2009 Posted February 9, 2009 (edited) Ah.. still have to prove to myself that there is a "which driver" issue, but that's essentially what I came here to suggest (look for tc on the system and run that if extant, otherwise try the penstick copy.) The bit that bothers me though is the collision between the risk of someone not encrypting something confidential because clicking say a shortcut to mount containers is jus too hard, and the risks of encouraging people to autoplay of USB sticks given it's now well-established use by malware. they might get a local admin passord And that will be very bad news unless you've got different ones for every machine- in which case how does it work when I go to another machine? Edited February 9, 2009 by PiqueABoo
box_l Posted February 10, 2009 Author Posted February 10, 2009 Arthur thats great! seems to be just what i need. i am guessing i cant use a cc3 package without cc3 so i will build my own msi piqueaboo i know, i just could not figure a way for a teacher to go to a non truecrypt domain machine where they are not a local admin and still get this to work. i will have to install to all machines on the school network for this to be fully usable. including all the student ones. i'll have to make sure the kids dont realise the software is there and encrypt things they shouldnt. thanks again Arthur:D
PiqueABoo Posted February 10, 2009 Posted February 10, 2009 i just could not figure a way for a teacher to go to a non truecrypt domain machine where they are not a local admin and still get this to work I decided not to care about that scenario. If they can do it on org's boxes including teacher laptops and on their home machines that's good enough for me. Ultimately this is supposed to be work/business data - why do you need to access that from any box anywhere on the planet?
jamesb Posted February 10, 2009 Posted February 10, 2009 I decided not to care about that scenario. If they can do it on org's boxes including teacher laptops and on their home machines that's good enough for me. Ultimately this is supposed to be work/business data - why do you need to access that from any box anywhere on the planet? Its not a problem scenario, its an undocumented security feature. You're restricting the machines where the data can be accessed to those you have authorized.
box_l Posted February 10, 2009 Author Posted February 10, 2009 piqueaboo, lots of the teachers i support have two machines, one for home one for class. i had not planned on putting truecrypt on the machine that never leaves school, so was a bit stuck on how they would have used the traveller stick on a locked down machine with no trucrypt. i'll just have to install to all machines. BoX
Arthur Posted February 10, 2009 Posted February 10, 2009 (edited) Box. My package will work for non-CC3 networks too. I didn't do anything special when I created the package that will only make it work on RM networks (I tried to copy what the official installer does as much as possible) so feel free to use it if you want. If you download the .exe from the link above and then extract the files to a folder you can then use the included .msi to install TrueCrypt to computers via Active Directory (or whatever method you normally use) and the files in the 'Traveller Disk' folder for your USB flash drives. When you install TrueCrypt from my .msi you will need to restart the computer so that the TrueCrypt driver starts properly. Edit. If you would like to modify my TrueCrypt package all you need to do is install TrueCrypt from my .msi on a clean PC, download the demo version of Advanced Installer and then open the included .aip project file. Make your changes to the package and then build the .msi again. Much simpler than starting from scratch. Edited February 10, 2009 by Arthur 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now