Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server program running on linux OS. I will need to give a PC with this program installed to someone to use for a while but I need to prevent the program from being copied illegally. I know it's impossible to absolutely prevent hacking. Wonder what I can do to minimize the odds.

Here are the tips I got by searching the web:

  1. lock the chassis of the PC with a padlock
  2. use password to protect the BIOS.
  3. use password to protect the grub

Note that encrypting home directory and putting the (server) program in the home directory is not an option since user of the PC may need to power on the PC to be able to access the service that the program provides.

share|improve this question

8 Answers 8

Physical access is tantamount to simply handing it over on a silver platter. But if you have to, you have to.

Some ideas:

  1. Make sure that it is NOT possible to boot from anything except the hard drive (no USB, optical, network, etc)
  2. Use SELinux to make the program only executable and prevent any other program from accessing it (i.e. prevent cat from opening the file). This could be hard or very easy.
  3. Go ahead and encrypt the filesystem. If the disk is "stolen" and the thief somehow decrypts the disk then there had to be some sort of communication between the someone and the "thief"
  4. Anyone can pick a lock. Use some sort of tamper evident seal that will be destroyed if anyone opens the box.
  5. Make sure that it is not possible to unmount the filesystem the program is located in. It is possible to read the raw device or lv.
  6. Make sure that the filesystem proc is not available. This may be difficult as some programs depend on it. It is possible to read and alter the program's memory and executable code using proc.
share|improve this answer
    
Thanks Allen for the good points. I will investigate SELinux and disable filesystem proc to start with. –  SafetyNuts Mar 23 '11 at 3:34
    
These steps also prevent legal copies, e.g. backups. The question was specifically about preventing illegal copies. –  Mike Scott Mar 23 '11 at 6:29
    
@Mike Scott: I do not think SafetyNuts is worried about backups of this particular server. Still, it is good that he should have that pointed out. –  Allen Mar 23 '11 at 17:44

Since most of the "protecting your physical machine" recommendations have been made, you may also want to think about another security feature you could add in addition.

Protecting your software from distribution onto non-authorized machines. Specifically, you could compile your package specifically for that person with additional hooks which inspect machine CPU ID + NIC Mac Address | md5sum and then cross-reference against your-predefined list of valid machines. Mind you, this of course will not work with interpreted code, nor is it perfect ( no method really is, given enough time ), but it's a thought.

share|improve this answer
    
Thanks delerious010 for the idea! I am so glad you mentioned it, I did add hooks in the program to compare UUID (from "dmidecode" command) to decide whether it was copied without authorization. –  SafetyNuts Mar 23 '11 at 3:31
1  
That doesn't prevent copying; it stops the copies from executing, which is not the question that was asked. –  Mike Scott Mar 23 '11 at 6:28

Make sure you set the BIOS so it can't boot a USB stick or PXE boot or boot from anything BUT the installed HD.

But this is probably best handled contractually with a severe penalty for copying the software.

share|improve this answer
3  
+1 As they old saw goes, there are seldom good technical solutions for behavioral problems. Copyright infringement is a behavioral problem, and needs to be solved in meat-space. –  rmalayter Mar 23 '11 at 3:25
    
Thanks for the caution and idea of using legal protection. I have set boot order to start with harddisk and BIOS is password protected. –  SafetyNuts Mar 23 '11 at 3:41

To prevent software from being copied illegally, simply authorise the recipient to copy it. Then any copies he makes will be legal.

If you want to prevent it from being copied at all, whether legally or illegally, that would be a different question.

share|improve this answer
    
That is a smartass answer and doesn't help at all. –  SvW Mar 23 '11 at 6:55
2  
I am attempting to make the point that people should think carefully about their questions before asking them. It's unclear what the original questioner is trying to achieve, because he's not given enough detail. Whatever he wants to do, it's not actually preventing illegal copying. –  Mike Scott Mar 23 '11 at 7:54
    
Ok, I got that wrong, maybe because I think it's clear what the OP wants, and that this may be difficult or impossible to achieve. Anyway, if you do some minor edit to your post my downvote will get unlocked and I can take it back. –  SvW Mar 23 '11 at 8:19
    
Sorry Mike that I didn't state my question clearly enough. The issue is that you need to give the system (PC with the program) to others who would like to trial it, but you don't know who among them had the intention to reverse engineer it. Of course, it's impossible to prevent the most determined hacker (I hope my software is not good to be worth their time) but I need to do my best to prevent it or deter it. –  SafetyNuts Mar 24 '11 at 2:00

I realize you were asking for technical solutions, but in my experience the layer 8 and 9 are just as important and often more effective.

Set up agreements that clearly stipulate what they cannot do, and what they must do to protect your code. Set up contracts that provide heavy penalties.

Also, preferably make it not in their best interest to try and grab the source. Try to establish a long term relation, and f.i. make the warranty expire if they open the box or run the code somewhere else.

share|improve this answer

If you machine has TPM then you can have ultimate protection. You can use trusted GRUB with encrypted partition for your program. This will give you protection even if hard drive is physically removed and connected to another host - the OS cannot be booted from it and encrypted partition cannot be read. You wouldn't need to even lock your chassis. Obviously, user should not be given 'root' access under any circumstances.

share|improve this answer
    
Thanks Dmitri for the idea, I also looked at this option. The question here is, when a user who physically has my system (PC + software), after he powers it up, doesn't he need enter some sort of password to mount the security encrypted partition (where the program resides) to run it? –  SafetyNuts Mar 24 '11 at 2:03
    
If you don't want the password then you can have no password - it is configurable. TPM with trusted GRUB simply provides a way to makes sure that critical components of the system were not tampered with. If everything checks no one will even know that you system is secured with TPM. –  dtoubelis Mar 24 '11 at 3:07

Consider re-implementing your program as a web service that they connect to over the internet?

As long as you don't need to push too much data back and forth it would allow you to keep your "program" isolated from something they control.

If you can't do that, you could have your program check in to a central server over the internet. If your program can't reach your server it disables itself. Basically it could check in and respond to a challenge algorithm... (you want to prevent the server from being spoofed)

share|improve this answer
    
That's a good thought Joel. It's a service I can potentially provide. There is a side effect that this program potentially generates lots and lots of data per second which will cost lots of money for the bandwidth consumed. –  SafetyNuts Mar 24 '11 at 2:05

There have already been some really good ideas posted by others, so Ill just build on the physical security.

I've previously been tasked with sourcing tamper evident seals and have not found anything I could recommend. In all cases the adhesive could be softened, usually with either turpentine or kerosine, the label removed and later reapplied. Done carefully you would never be able to tell the seal had been removed.

Forget about padlocking the case. As has already been pointed out (almost) anyone can pick locks.

I suggest you use physical seals instead. I prefer the old fashioned type consisting of wire and a crimped lead seal. Primitive, yet surprisingly effective, which is why they are still being used for many security situations.

share|improve this answer
    
Thanks for the idea of using seal, this seems to be a very interesting idea, could you send me a link to this seal? –  SafetyNuts Mar 24 '11 at 2:07
    
@SafetyNuts, I don't have links for my supplier but here's one chosen at random from a Google search for "wire seals": americancasting.com/info-wire-seals-01-toc.asp –  John Gardeniers Mar 24 '11 at 3:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.