I need to convince my customer that my server to which he submits his sensitive data runs only applications/processes approved by him. Also the customer is not allowed to get access to my server. He also needs proof that I cannot modify any of the running processes after he makes an audit.

My idea was to create an Amazon AMI, pre-load it only with applications of the customer. There will be no SSH access or any kind of access to that image in order to guarantee that no changes can be made to it. The only interface to the outside world will be a process listening for incoming connections.

Is it possible to implement this using AWS? My concern is that AWS has no mechanism to make an instance read-only, such that even the filesystem could be locked from modification by external means.

Any suggestions? Any services which provide independent verification?

  • OK, I guess it is possible to lock down the server. The question stands: how do I prove to my client that he has been communicating with a locked-down server. – abirvalg Apr 14 '13 at 8:44
  • Assuming the criteria is "no ports accessible" and "read-only file access" (and the client is able to understand what you are showing them), you could demonstrate both with the results of a port scan and the output of the mount command. – ianjs Apr 15 '13 at 6:49
  • So, if the instance ever winds up crashed or compromised, you'll have no way to troubleshoot, diagnose, or fix? – ceejayoz Apr 16 '13 at 14:50
  • You can freeze the crashed instance, launch a new one instead. Then investigate the post-mortem image of the crashed instance. – abirvalg Apr 17 '13 at 15:20
  • What sort of solution did you end up going with? – Drew Khoury Jun 25 '13 at 1:28

There is no such thing as a tamperproof system. Even the most secured systems on the planet could still be breached given enough time and money. That being said I doubt your clients need the level of security of the Pentagon.

You need to work with your client to define exactly what is meant by tamperproof including the threat they want to mitigate. Once you know what they want it will be much easier to work towards making it happen. Presenting them with a bunch of information (which may or may not be off the mark) will not inspire confidence.

| improve this answer | |
  • How about a reputable third-party verification? A thir party will simply certify that only such and such applications were run. What my customer wants is simple: a guarantee that only certain software was run on the server. – abirvalg Apr 16 '13 at 13:49
  • @abirvalg - good idea, assuming your client agrees with it. – Tim Brigham Apr 16 '13 at 16:16

This is not an Amazon issue so much as a general issue with locking down a server.

You can:

  • disable all services including ssh,
  • Mount all disk volumes as read-only at boot time,

then create the AMI. When you launch an instance of that AMI it will only run the services you have set up.

I'm not sure how you will be able to "prove" this other than to demonstrate the procedure you used to create the AMI; there will presumably have to be at least a basic level of trust between you and the client.

| improve this answer | |
  • Thank you, but the "proof" part is essential. Can my client request proof from Amazon that my server has been running this AMI all along (of course I will authorized beforehand that Amazon provides such proof on demand). But I fear that Amazon simply doesn't provide such service. – abirvalg Apr 14 '13 at 8:38
  • sign your drivers and check sum them when needed – Guy Apr 14 '13 at 15:37
  • Drivers? DO you mean system libraries? – abirvalg Apr 14 '13 at 18:41
  • 1
    the instance ID is unique and the AWS console shows the AMI that it was launched from, so in that sense AWS does provide such an audit trail. Provided it is still the same instance id, it was created from the designated AMI. Keep in mind though, that there is no way you can prove that a server is absolutely secure, only that it is insecure. – ianjs Apr 15 '13 at 7:08

Why not just help your client setup an AWS account that only they have access to, and create scripts to setup the server exactly how you like (I'm talking about DevOPs ... Puppet or Chef etc). Then you can walk the client through setting up a blank AMI, applying a configuration they approve, and a machine they have FULL control over. You could walk the client through setup of an AWS Account, new AMI, and running a pre-made Puppet script in less than 1 hour.

As for communication with this machine...You should consider VPN and SSL etc to try and ensure communication is secure. There will always be security concerns around DNS and Man In the Middle attacks so the risks should be outlined and understood.

| improve this answer | |
  • Unfortunately the client is not allowed to have access to the server. He only needs to have proof that the server adheres to a certain protocol while processing the data that the client submits to it. – abirvalg May 14 '13 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.