Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server and several clients (The technology is not important in the moment. It can be any.).
I need to authenticate the computers. They are located in several offices geographically allocated with dynamic IP addresses.

I do not trust the people working on the PCs so I do not like username/password authentication.

So I need only the programs installed on those computers to access the server. If the programs are cloned (or the OS is cloned) to another PC the server should reject them.

How can I do this?
(Will VPN solve this. Are there other methods ?)

share|improve this question
1  
This kind of thing is actually quite easy to do but requires a programmatic solution, which is way outside the scope of this site. –  John Gardeniers Nov 10 '10 at 3:22

5 Answers 5

up vote 2 down vote accepted

You might be in the market for a hardware token-based solution like the Yubikey. So, now they can still clone away but they will still have only one yubikey and therefore only one functional computer.

The cost is reasonable (I think):

  • 1 at US$25 each
  • 10 at US$20 each
  • 100 at US$15 each

But for a software only solution ... why not load the computer with an SSH certificate and only allow one login per certificate. It will not prevent cloning but the effect is the same.

You might want to add a check on the cpuid so that if a certificate is used to authenticate a client from several different clients you reduce the lifetime of the cert, or do some other annoying thing. Note that the cpu id is not very trustworthy but it does raise the bar a little for the cloner.

share|improve this answer
1  
I should have mentioned TPM. But it's just as likely that the system will not have it. VPN will not solve it. –  Allen Nov 9 '10 at 19:03

The easiest method - but also a method that can be easily tricked would be to check the MAC Adress of the network card.

You can't rely on any key or method that relys on any key that is generated-once, but than just get's used. You need to rely on a intermediate hardware token or on a token that get's stored in Hardware.

The later can be achieved by using TPM. You might want to investigate in this topic.

Edit

In short TPM let's you store tokens on a hardware based storage. This will effectively prevent cloning of your machines.

You might even go that far and encrypt the harddrive based on a TPM based key.

share|improve this answer
1  
+1 for mentioning the TPM. No upvote for the MAC address bit-- that's not security. A TPM is about the only way to go about what the poster is asking for and, even then, it's a long shot. Assuming the users of these computers don't have the equivalent of "superuser" access and the computers are using full disk encryption with a boot-loader that allows the TPM to insure "trust" in the OS then the post has a chance. Even then, you're banking on a lot of "moving parts" working in a bug-free fashion to keep this trust up. –  Evan Anderson Nov 9 '10 at 19:23

There's no such thing as "only programs can access". Either they can be accessed by a given account / method, or they can't. What kind of resources are you sharing, just documents? If you use a simple username / password-based method you can always change / delete their account of they do something of concern.

Similarly you could set up VPN-based access which would let you restrict connections based on MAC address which (within reason) would allow you to restrict access to specific pieces of hardware and defeat a copied OS.

share|improve this answer

I don't believe there's a way to do this. Basically you want to authenticate clients without passwords so the user has no say in the authentication, suggesting that all "secrets" are stored on the machine itself.

If the machine can be cloned, then storing the secret on the machine (such as for password-less VPN) is not an option. If the client cannot be trusted, then having the secret stored off the disk is not an option, so you'd need to find some way to determine their identity without being able to trust the filesystem or any users.

There are ways to do this, such as restricted based on IP address (which you state isn't an option), and restricted based on some hardware ID (such as MAC addresses), which can be spoofed.

EDIT: Storing a private key on a USB drive could be an option, but it's still susceptible to cloning.

share|improve this answer

USB crypto key + superglue. (e.g. eToken PRO). The entire premise of them is that they keep the private key secret / protected and do the cryptographic functions on the key itself, never exposing it to the computer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.