up vote 1 down vote favorite
share [g+] share [fb]

I am running a server with proprietary software on it that my users can execute via SSH. However, I would like to disallow the download of that software (e.g. the directory containing the executables, etc.) from my server with SSH.

How is that possible? Is it possible at all? If not, is there some kind of byte code protection mechanism like Games do with License Keys?

link|improve this question
86% accept rate
feedback

migrated from stackoverflow.com Aug 1 '11 at 16:22

This question came from our site for professional and enthusiast programmers.

6 Answers

up vote 2 down vote accepted

You need to use the sudo mechanism.

  1. Create a special user owning the software "foo-user"
  2. Install the software and change the owner of the files to "foo-user", remove group and other user's privileges to the files (chmod go-rwx)
  3. Add users to /etc/sudoers that will be able to run the software: 
    user (ALL)=(foo-user) /path/to/software
  4. Either instruct users to use sudo -u foo-user /path/to/software for running it, or prepare .desktop files for them.

The downside is that the foo-user needs to be able to access the user home directory for user to be able to edit his/her own files. If you have multiple users that need access to software it may be a problem.

Also, if the software in question has any advanced file-management functionality it may be possible to use it to copy its own files out of the restricted folder. umask should prevent it, but then editing files will be more problematic.

For GUI apps you may use kdesudo or gksudo.

link|improve this answer
The program will still be loaded into memory, so is the user not able to read it from there? – Heinrich Aug 2 '11 at 16:05
No, entries in /proc will be owned by the foo-user. – Hubert Kario Aug 2 '11 at 20:49
feedback
up vote 2 down vote

Run the shell in a chroot jail and make the software (running outside the jail) accessible over ports/sockets/whatever.

link|improve this answer
Thats nice, but only works for command line based software. How about GUI stuff? – Heinrich Aug 1 '11 at 19:17
Look into X forwarding, a computer serving a GUI program can run it out of the chroot jail and still let it be accessible. – spraff Aug 2 '11 at 11:56
feedback
up vote 0 down vote

Run the software through a proxy that acts as an intermediary for input/output between the user and the program. That way the user doesn't have access to the bytecode and thus copy it (as mentioned in user unknown's answer).

link|improve this answer
feedback
up vote 0 down vote

You can set the x bit on a file without setting the r bit, so long as the file is suid to a user that can read the file. This will allow the user to execute the file without being able to read it, but they may still be able to get the contents of the file through the /proc/ filesystem while it's executing.

link|improve this answer
theoretically yes, practically no. With 2.6.38 I'm unable to run application to which I have only the "x" permission. – Hubert Kario Aug 2 '11 at 11:14
@Hurbert, you're right: it only works for suid executables where the application can then read its own file. I've corrected my answer. – Andrew Aylett Aug 2 '11 at 11:18
feedback
up vote 0 down vote

Would lshell work for you? Setup a restricted shell for your users so they can only execute the software you want, and disable everything else including ordinary shell commands and sftp/scp. Also all the forbidden commands will be logged so if someone tries to copy something, (s)he will get caught soon enough.

link|improve this answer
I think not, as I would like to offer my users a fully-features linux, – Heinrich Aug 2 '11 at 16:04
feedback
up vote -2 down vote

I would say a good EULA. Anybody, who really wants to get your code would figure out a way to get it. So have a good License agreement in place.

link|improve this answer
A EULA's purpose is to provide a recourse AFTER the agreement has been broken. It does nothing to prevent it being broken. It's on a par with leaving your keys in the front door lock with a note pinned to the door pointing out that it's illegal to enter the premises without permission. – John Gardeniers Aug 1 '11 at 21:38
Agree John; I assume one would due diligence to prevent your code from being stolen; but at the same time in above question if user has excess to code, they can get the byte code one way or another. I would love to know if that can be prevented. – Raj J Aug 1 '11 at 21:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.