1

I have access to a shared remote computer from which I would like to run some code I have written which uses an interpreter (not a compiled code). I would like to protect this source code from other users who have root access to the remote machine. There are a variety of ways to make an encrypted folder in linux. I am not writing a lot of data to the disk so I am not worried about reduced I/O speed due to the encryption process, just mainly using many CPUs and a lot of RAM on this machine.

My question is, do any of these encryption options allow the data to be protected from the root user, when I am logged in and have the filesystem mounted? A main concern is if a cron job running as root does a backup, then the source codes are automatically copied to another filesystem without even realizing it and then it is no longer encrypted.

| improve this question | |
2

If you can access your data, root can access your data. You have to trust root!

Even if you access encrypted data on a remote machine, root can see it (you use the tools provided by root, right?).

You can only make it harder to access your files, but never impossible. If you want your data to be save, don't use untrusted machines.

| improve this answer | |
1

You could run a Network Block Device server on the box, and crypt-mount that locally on your own machine, then the remote root would only see encrypted dataflow. But that way the remote box has no access to unencrypted data.

If the remote box is doing the decryption by itself, so it has access to the data on its own, then the remote root has also (ways of getting) access to it. It can't be helped.

You have to be able to trust whoever owns the box that runs your code.

| improve this answer | |
  • I don't think the Network Block Device would do any good because I'm not trying to store or transfer much data to the remote machine.I am wondering if running a virtual machine on the remote machine would help. I could encrypt the filesystem on the virtual machine, and this decryption would be controlled by the virtual operating system. – user1748155 Feb 5 '13 at 16:21
  • It may be possible that some of the data could be in the RAM on the remote machine that root could access, but I don't think they are going to have the sophistication or desire to access any meaningful data that way, and I don't think a backup program would accidentally copy the data this way. – user1748155 Feb 5 '13 at 16:25
  • Does anyone see any flaws in using an encrypted virtual machine other than data in RAM potentially could be accessed somehow? – user1748155 Feb 5 '13 at 18:22
  • In principle the problem remains the same regardless how sophisticated a software solution you employ. So you're betting on root not having the know-how necessary. – frostschutz Feb 5 '13 at 19:27
0

Briefly, there are ways to obfuscate your activities from root (i.e. creating an encrypted file container, using non-local keyfiles to unlock it, and storing data on it) but ultimately if someone with root access is dead set on finding that information, it's just not that difficult (using strace on any process that accesses/decrypts your data, for example.) Please don't take this as innuendo, but if you have a legitimate reason to run code you truly don't want other people seeing, you really need to make a request for your own private machine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.