0

I need to send a custom linux machine to client(s) that has a local server database running. The goal is to make them as plug and play as possible.

For example:

  1. Plug ethernet cable into server box
  2. Plug power cable into server box
  3. Push power button
  4. Server starts when it is fully booted

My issue is figuring out the most effective way to safeguard the database data. However, I don't really want the user to do any extra work to login as I don't think I will have a graphics card or any peripherals attached. Basically, I want my grandma to be able to figure this box out.

Something to note: The network this device is on will most likely have only whitelisted incoming connections allowed or no outside connection at all so the goal here is to mitigate a physical intruder.

I've come up with two solutions and it would be greatly appreciated if anyone could take the time to give me their opinions and or any guidance on my viable options; because I'm sure there are a lot more smarter people out there that have better ideas when it comes to these things.

Thank you!


Solution 1

Use a USB key as a mechanism for auto-signing into the machine (PAM Module?). That way the data can be encrypted safely.

Solution 2

While this is definitely the less secure method and a bit more work then I was hoping but - I could delete the files that hold the database data on boot and then have a welcome page on the local server's IP where the user types in the password in which it then restores an encrypted backup on another mounted drive.

This way, the only way the data could be stolen is in between shutting down the device and turning it back on.

Bonus Solution

A mixture of the two.

  • For solution 1, how are you going to get the USB key to the client? – Philip Kendall Mar 27 '18 at 6:07
  • @PhilipKendall Just handing it off when I give them the machine probably – bryan Mar 27 '18 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.