1

I am running a server with proprietary software on it that my users can execute via SSH. However, I would like to disallow the download of that software (e.g. the directory containing the executables, etc.) from my server with SSH.

How is that possible? Is it possible at all? If not, is there some kind of byte code protection mechanism like Games do with License Keys?

6 Answers 6

2

You need to use the sudo mechanism.

  1. Create a special user owning the software "foo-user"
  2. Install the software and change the owner of the files to "foo-user", remove group and other user's privileges to the files (chmod go-rwx)
  3. Add users to /etc/sudoers that will be able to run the software:
    user (ALL)=(foo-user) /path/to/software
  4. Either instruct users to use sudo -u foo-user /path/to/software for running it, or prepare .desktop files for them.

The downside is that the foo-user needs to be able to access the user home directory for user to be able to edit his/her own files. If you have multiple users that need access to software it may be a problem.

Also, if the software in question has any advanced file-management functionality it may be possible to use it to copy its own files out of the restricted folder. umask should prevent it, but then editing files will be more problematic.

For GUI apps you may use kdesudo or gksudo.

2
  • The program will still be loaded into memory, so is the user not able to read it from there?
    – Heinrich
    Aug 2, 2011 at 16:05
  • No, entries in /proc will be owned by the foo-user. Aug 2, 2011 at 20:49
2

Run the shell in a chroot jail and make the software (running outside the jail) accessible over ports/sockets/whatever.

2
  • Thats nice, but only works for command line based software. How about GUI stuff?
    – Heinrich
    Aug 1, 2011 at 19:17
  • Look into X forwarding, a computer serving a GUI program can run it out of the chroot jail and still let it be accessible.
    – spraff
    Aug 2, 2011 at 11:56
0

Run the software through a proxy that acts as an intermediary for input/output between the user and the program. That way the user doesn't have access to the bytecode and thus copy it (as mentioned in user unknown's answer).

0

You can set the x bit on a file without setting the r bit, so long as the file is suid to a user that can read the file. This will allow the user to execute the file without being able to read it, but they may still be able to get the contents of the file through the /proc/ filesystem while it's executing.

2
  • theoretically yes, practically no. With 2.6.38 I'm unable to run application to which I have only the "x" permission. Aug 2, 2011 at 11:14
  • @Hurbert, you're right: it only works for suid executables where the application can then read its own file. I've corrected my answer. Aug 2, 2011 at 11:18
0

Would lshell work for you? Setup a restricted shell for your users so they can only execute the software you want, and disable everything else including ordinary shell commands and sftp/scp. Also all the forbidden commands will be logged so if someone tries to copy something, (s)he will get caught soon enough.

1
  • I think not, as I would like to offer my users a fully-features linux,
    – Heinrich
    Aug 2, 2011 at 16:04
-2

I would say a good EULA. Anybody, who really wants to get your code would figure out a way to get it. So have a good License agreement in place.

2
  • A EULA's purpose is to provide a recourse AFTER the agreement has been broken. It does nothing to prevent it being broken. It's on a par with leaving your keys in the front door lock with a note pinned to the door pointing out that it's illegal to enter the premises without permission. Aug 1, 2011 at 21:38
  • Agree John; I assume one would due diligence to prevent your code from being stolen; but at the same time in above question if user has excess to code, they can get the byte code one way or another. I would love to know if that can be prevented.
    – Raj J
    Aug 1, 2011 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .