Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I was in grade 8, my entire class took a road trip to Quebec in order to "learn french". We basically just ran around Montreal speaking english and having a blast, but come night time, the chaperones would close our doors, and place a piece of masking tape across it so that any idiot who left his room at night would could be reprimanded (since the tape would be removed from it's original position) - still with me?

How can I do something like that on a windows box? Answers for linux machines appreciated as well, but my predicament is windows specific.

I am renting a server from a cheaper company at the moment, and don't entirely trust them to be honest.

How can I tell if/when said company accesses my dedicated server without my knowledge?

share|improve this question

migrated from stackoverflow.com Oct 23 '11 at 7:13

This question came from our site for professional and enthusiast programmers.

2  
If they have physical control of the server, then you can't tell if they access it. Period. –  Greg Hewgill Oct 23 '11 at 7:05
3  
Send an email every time someone logs on? –  Lasse V. Karlsen Oct 23 '11 at 7:14
14  
If you don't trust them, then you shouldn't be renting from them. Simple as that. –  Tom O'Connor Oct 23 '11 at 8:33
2  
I wonder what the chaperon would have done if someone smart left their room - for instance, had I left my room, I'd have moved the tape on all the doors. :> –  Cyclops Oct 23 '11 at 17:15
2  
@darkAsPitch if they really wanted, they could take the drives out and clone them one by one until they have a replica of all of your data. They would never have to log in, and assuming that you're using RAID, you might never know. By the time you can answer the alerts, it's too late. –  MDMarra Oct 23 '11 at 22:03
show 3 more comments

5 Answers

up vote 8 down vote accepted

Anyone with physical access to the machine, or access to the host if the machine is virtualized, can gain access and there is absolutely nothing you can do about it. The drive, whether physical or virtual, can be cloned and installed into another machine. If desired they can make whatever changes they like and put the drive, or the clone, back where they found it.

This is why a business cannot afford to place into the hands of a hosting/co-location facility anything they don't wish to share. Of course encryption is a help but that's not the area under discussion here.

share|improve this answer
    
Good point. Thanks again! –  darkAsPitch Oct 25 '11 at 8:10
add comment

The problem with your analogy is that in your case you're really worried about the hotel owner being a pedophile.
All the tape in the world won't help: they can simply keep the chaperone off the floor for a while & re-tape the door when they're done.

Instrumenting your servers is a good step to montor against attacks, but you need to find a hosting company you trust, otherwise anything you do can be circumvented to some extent by the hosting company.

share|improve this answer
    
Point taken. I suppose I have to gauge now how far they might go. Or find greener pastures. –  darkAsPitch Oct 25 '11 at 8:08
add comment

the email can be intercepted if it's sitting in there data center.

There are ways around it but linux has something called the atime parameter when you mount a disk it writes down every time someone accesses a file of course this doesn't stop them from mounting it with a boot disk set to noatime. Windows probably has something similar with the same fault, but that's your best bet unless you can find a hardware solution, maybe do that in combination with drive encryption? or have a second server sending requests for objects off the disk and consider it a security breach when there is downtime. Have that object be reading off the access times encrypted with a one time pad kept only in ram last hand off in the pad feeding a new pad the initial seeding of the first pad would have to be on site and could not be stored there. You could also just use another cryptographic approach like ssl or something, but one time pad is pretty hard to beat.

there's even ways around the pad idea, but that's reaching the just silly point, and if your data is valuable enough to be worth past the just silly point you should trust your provider. The just silly point being figuring out a way to have the drive shared with a second host without the first hosts cooperation or popping the ram freezing it and breaking out the electron microscope. Doing more than the email idea might even be past the just silly point.

share|improve this answer
    
I like your thinking squishy. Mainly the verifying connectivity regularly. If I checked my server's up-time every 10 seconds... it should only cost me ~1MB of bandwidth per day, plus I receive the added benefit of knowing my expensive host's real up-time percentage. Thank you. –  darkAsPitch Oct 23 '11 at 7:46
add comment

You may create a batch file who save the time of the PC uptime when in it is run.

The content of the *.bat file could be something like this:

net stats svr > C:\LastUptime.txt

The result of that command is something like this

Server Statistics for \\RPOLOPC


Statistics since 22/10/2011 10:48:53 p.m.


Sessions accepted                  1
Sessions timed-out                 0
Sessions errored-out               0

Kilobytes sent                     0
Kilobytes received                 0

Mean response time (msec)          0

System errors                      0
Permission violations              0
Password violations                0

Files accessed                     0
Communication devices accessed     0
Print jobs spooled                 0

Times buffers exhausted

  Big buffers                      0
  Request buffers                  0

The command completed successfully.

You may change the > in your script to >> if you dont want the file to be rewrited instead to append to the existing file each time.

After you have the script create a Basic Task using the Windows Task Scheduler to run it every thime when the PC starts.

share|improve this answer
add comment

Why don't you just get a locking case with a tamper switch (Dell and probably everyone else makes cases with these enabled)? Make sure your BIOS has a password set (so they can't simply PXE boot it to another OS), and you should be pretty much set.

share|improve this answer
    
If the machine wasn't 3,000 miles away, I would :P –  darkAsPitch Oct 25 '11 at 8:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.