5

In a remote box, my files are 700-chmoded, but I'm worried that root may be reading them.

Is there a way to add another layer of protection to avoid that, perhaps by encrypting them, but allowing smooth on-the-fly decrypting when programs run by me request them?

My typical use is a GNU screen session with irssi and vim running.

Thanks!

8 Answers 8

17

Thinking about it logically - without touching on any specific technologies - if it's not your machine and you don't trust root then you have a problem.

You really can't do anything about securing screen and irssi. Root will always have permissions to force the attachment of screen sessions, to sniff IRC traffic from the network or potentially to peek into the contents of process memory.

You could encrypt files with keys and passwords. But it would require the system having access to the encryption keys when required, which in turn means that root would also have access and that they could be attacked with brute force. Unencrypted files would be present in memory or disk for the period of time that they were used, and you guessed it, root can see those too.

1
  • 7
    I have to agree here, if it is not your machine, and you do not trust root, and your files are sensitive, you need to put your files somewhere else. root is GOD and can do and see all.
    – Kevin K
    Oct 1, 2009 at 11:17
10

No. Root sees all, knows all.

1
  • I laughed more than I should :D Oct 28, 2013 at 0:56
4

I'm not sure that any solution is going to work. What's to stop root signing in or su'ing to your user? Even if you require a password to be typed in the root user could easily set up a keylogger to trap it. The solution, if you don't trust the root user of the server you're using, is to use a different server.

2

This cannot be done, in any true meaning anyway.

If you don't trust the administrators you're out of options - there's always a way for them to get to the data as they control your hardware and your infrastructure.

Regulate access through written policy.

2

On a regular Linux (or Windows, or most other OSes) this is not possible. As the other answers point out, root / System administrator can by definition do everything on the box, and can circumvent any protection you set up (even in a way that you cannot detect).

That said, what you describe is possible using an OS that uses mandatory access control. Examples would be Trusted Solaris, or SELinux. On these systems, you can restrict even the rights of root/SysAdmin to the point that scenarios like yours become possible. It is still fairly tricky to set up though, and will probably cause significantly more work in configuration and use. So practically speaking, it's not possible.

1

Store AND TRANSMIT the files in encrypted form, so that the plaintext never leaves your machine. Also keep hashes to verify all data.

That way the worst that can be done is denial of service.

-1

Large enterprise systems are by default protected even from the possible root hacks by the access control systems such as RBAC or some variant of MAC. Sleske's comment supports this statement. Check Wiki for more details. However, if you are user on the smaller or medium size system you must that must have "all-mighty but not trusted" root account you have to develop "double-books" system based on the autonomous virtual machine in charge of the user session and another virtual machine in charge of the root's server session. Bill Michaelson

-2

Create a virtual machine with OS of your choice, preferably with encrypted filesystem, and place your secret files there. If possible, set up a token-based or biometric authorization instead of, or in addition to, username/password

1
  • This will not help at all. If you have root on the host machine then you have complete control of the virtual machines. If nothing else root will be able to suspend the virtual machine to disk and just extract any crypto keys from the state file (the "RAM" from the virtual machine).
    – Thomas
    Oct 2, 2009 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .