How are locked-down file perms in Linux similiar/different to Win EFS?

This is when you switch to a business process and credit card processor that does not require storing credit card numbers locally and let someone else deal with the PCI hassle.

I hadn't considered physical security or backup security, so I guess I won't push back further on my colleague and instead will go ahead and make sure nothing is written in plain-text. I'm confident that the disks (and any backups that may exist) are physically secure, but since I don't have any control over that I won't rely on it. Likewise, I know there are Linux alternatives to EFS, but I'd rather keep things secure at the application level than rely on disk encryption (mostly due to weird interpersonal politics). So thanks for the answers, folks, it's clear the whole process needs to be reworked.

Agreed, and that's in the works, but not a short-term possibility.

So... you're saying that you have code that takes the credit card information in the database, decrypts it, and writes it to disk as a plain text file? If so, I don't think there's any way to construe any other security mechanism to be equivalent to encryption. File permissions are simply that particular OS promising that it won't look at the file. The first thing that comes to mind is that if that file gets backed up somehow, it's unencrypted on the backup medium. Or for example if the server you're on is virtual or gets virtualized in the future, the underlying host OS has access to it unencrypted.

I don't know who is interpreting the PCI requirements how, but there are three options for encryption on Linux that I'm aware of. http://superuser.com/questions/182099/what-is-the-easiest-way-to-encrypt-a-dir-on-ubuntu/182221#182221. Basically: Yes, Linux can be made to do exactly what you want it to do, or made to do a couple of other things. Your default Linux with 0600 permissions is indeed making it so that only root, the logged in user, or anyone with physical access to the disk who can mount it as root (ie: fire up a thumb-drive install) can read it. this almost certainly isn't compatible with the PCI requirements. Something like a truecrypt encrypted volume as the home directory for a specific user is probably closer to what you're asking for, but I'm rooting for http://ask.metafilter.com/238346/How-are-lockeddown-file-perms-in-Linux-similiardifferent-to-Win-EFS#3455647.

Perhaps you should look into http://ecryptfs.org. This isn't "whole disk" or image encryption, but is layered on top of an existing filesystem. Maybe this might satisfy your requirements. While you're at it, don't forget to http://code.google.com/p/cryptsetup/wiki/DMCrypt your swap space while you're at it, that can also hold data that you might not want released! What does your OS vendor say about this? I'd want to consult them about this. You DO have production support on this obviously important-to-your-business server, yes?

In linux if you log in as root you can look at anything, so any attacker who gains root access can look at any unencrypted file. In addition there's the physical access part. Anyone who can boot the machine to outside media (thumb drive, usb drive, cdrom, flopp disk) can mount the disk as root and read it, no problem, if it's not encrypted. I don't know much about EFS but I'd be surprised if this was the case - the point of encrypted file systems is that they only decrypt if you have the key, and the administrator probably shouldn't have the ability to do so.

Mmmmh. You probably already thought about this: When I read "AES encryption" I think of symmetrical encryption. That would mean that the means of decryption are present on your web server. I consider that bad because if your webserver gets hacked there is a probability that the hackers could decrypt the transactions that are already present. I would consider public key encryption for soemthing like that. This way no hacker can get at the data that is already present at the time of the hack. You could arange for the administrative users to send the private key for decryption together with the request to send the files to the credit card processer. This would make it a little more inconvenient for the useres because they have to be in posession of the private key but I think it would make it much more secure for their customers. The administrative users have the private key but cannot get to the transaction files. The web server has the files but no private key. This protects old transactions nicely if either were hacked. The private/public key pair can be changed as often as deemed necessary. Hacking the web server would gve you access to all new transactions but that is something that probably cannot be protected against at all.

To answer the question, no, Windows EFS and Linux permissions are not the same. In Windows EFS, the data exists on the disk in an encrypted format and is decrypted on the fly when it is accessed by an authorized user. It is always encrypted on the disk. Whereas permissions are only as good as the OS heeding them. If you plug a linux disk into another box, you can see anything you want. What you probably want to do is set up a process where the data never even hits a disk- have your database pipe its output to a ramdisk which the webserver can see. Or better yet, have the database (somehow) connect directly to the CC processor when the "submit data" button is pressed.