Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In a remote box, my files are 700-chmoded, but I'm worried that root may be reading them.

Is there a way to add another layer of protection to avoid that, perhaps by encrypting them, but allowing smooth on-the-fly decrypting when programs run by me request them?

My typical use is a GNU screen session with irssi and vim running.

Thanks!

share|improve this question
add comment

7 Answers

up vote 16 down vote accepted

Thinking about it logically - without touching on any specific technologies - if it's not your machine and you don't trust root then you have a problem.

You really can't do anything about securing screen and irssi. Root will always have permissions to force the attachment of screen sessions, to sniff IRC traffic from the network or potentially to peek into the contents of process memory.

You could encrypt files with keys and passwords. But it would require the system having access to the encryption keys when required, which in turn means that root would also have access and that they could be attacked with brute force. Unencrypted files would be present in memory or disk for the period of time that they were used, and you guessed it, root can see those too.

share|improve this answer
7  
I have to agree here, if it is not your machine, and you do not trust root, and your files are sensitive, you need to put your files somewhere else. root is GOD and can do and see all. –  Kevin K Oct 1 '09 at 11:17
add comment

No. Root sees all, knows all.

share|improve this answer
    
I laughed more than I should :D –  Sibin Grasic Oct 28 '13 at 0:56
add comment

I'm not sure that any solution is going to work. What's to stop root signing in or su'ing to your user? Even if you require a password to be typed in the root user could easily set up a keylogger to trap it. The solution, if you don't trust the root user of the server you're using, is to use a different server.

share|improve this answer
add comment

This cannot be done, in any true meaning anyway.

If you don't trust the administrators you're out of options - there's always a way for them to get to the data as they control your hardware and your infrastructure.

Regulate access through written policy.

share|improve this answer
add comment

On a regular Linux (or Windows, or most other OSes) this is not possible. As the other answers point out, root / System administrator can by definition do everything on the box, and can circumvent any protection you set up (even in a way that you cannot detect).

That said, what you describe is possible using an OS that uses mandatory access control. Examples would be Trusted Solaris, or SELinux. On these systems, you can restrict even the rights of root/SysAdmin to the point that scenarios like yours become possible. It is still fairly tricky to set up though, and will probably cause significantly more work in configuration and use. So practically speaking, it's not possible.

share|improve this answer
add comment

Store AND TRANSMIT the files in encrypted form, so that the plaintext never leaves your machine. Also keep hashes to verify all data.

That way the worst that can be done is denial of service.

share|improve this answer
add comment

Create a virtual machine with OS of your choice, preferably with encrypted filesystem, and place your secret files there. If possible, set up a token-based or biometric authorization instead of, or in addition to, username/password

share|improve this answer
    
This will not help at all. If you have root on the host machine then you have complete control of the virtual machines. If nothing else root will be able to suspend the virtual machine to disk and just extract any crypto keys from the state file (the "RAM" from the virtual machine). –  Thomas Oct 2 '09 at 7:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.