2

I have no experience using Ubuntu before

I'm doing a point of sale project for a restaurant which will run in local Lan (offline not online). I will setup one mini PC as an Ubuntu web server. and my client will access into it via local lan via http request. The server will be placed inside the restaurant.

Is it possible to protect from someone who wants to steal my file or clone the entire disk and use it with another restaurant?

Or Ubuntu already has some mechanism inside to protect someone from doing this, e.g. password require before transfer file out of the computer? or password needed before clone the disk?

I know nothing about Ubuntu, can you please tell me the easiest way to protect my project from being stolen?

1

Disk encryption only works to the point where you've got somebody manually unlocking it. If the server can boot itself and start up without human interaction, if somebody gains access, they've got the data.

Here are a few ideas ranging from basic to silly.

  • Lock the server in a box. Bolt the box to a wall. Treat it like a safe.

  • Make the restaurant contractually liable for the physical security of the software. Make it known that their copy is watermarked and if it ends up on a torrent site, they're liable for the lost sales. But do it without sounding like a douche.

  • Physical port blocking: Blank off any USB, serial, etc ports.

  • Glue SATA cables into their ports (and block other SATA ports).

  • Lock the BIOS. Disable other SATA ports. Disable USB. Disable everything you're not using.

  • Rebuild the kernel with make localmodconfig so the only drivers your kernel has is for the hardware it's dealing with.

  • Consider full-disk encryption with a physical key like a smart card or a good biometric system. Staff will leave smartcards in (because they've got better things to do) but biometric might work if you implement some sort of auto-shutdown at the end of the day.

  • Physical DRM. Dongles devices that form part of the code execution. They're really expensive to create and aren't insurmountable (cite: Autocad's torrid and failed relationship with dongles).

  • "Phone home" if the server is opened. Script something up that looks at internal light levels. If they increase dramatically, trigger a SMS via an attached dongle (you might be introducing a new attack vector).


A lot of these things don't just make the server more secure, they make it much less robust and harder to fix... Most of these countermeasures are at least an extra point of failure.

Consider that with most applications, their maximum shelf-life is five years. Making this cheap enough not to bother stealing might be a better strategy.

  • What about if I make the server runs 24/7. and it need password to start running. And when I sell my project I fill the password to run it. after that if someone clone it, they need password to start the server? can they change the password or hack or maybe it is not worth time doing? anyway thank you so much for your creative solutions and your patient haha – Team Dec 20 '13 at 14:10
  • @Team: That solution would give some problems if for instance the power went out or something like that. I've gotten really good results using a usb to decrypt the drive (using full drive encryption). I did this by installing the decryption software onto the usb and make that bootable. I put a check in there that checks if you're still using the same bios it enters the password (a full 128 bit password). The same thing is also possible using a truecrypt extension that checks if you're still using the same bios before prompting: "enter password". I'll try to find where I got that extension – Akisame Dec 20 '13 at 14:29
  • ok so if they clone to another pc with other bios they will not be able to run the server? or they are able to run but not able to edit data? thank you very much for your suggestion my friend. can you please suggest me links or the program you use? for ubuntu? – Team Dec 20 '13 at 14:36
  • They will not be able to boot the server if the bios changed if you follow my suggestion. My friend here said that he used an bit of a obscure trick. He got truecrypt to check the bios version and info etc and used that as a password. It's quite hard to figure out what the password is (but once you've cracked the trick it's quite easy, it is a bit less secure than my previous suggestion). The plus side to this is that it is A LOT easier to setup than my suggestion and only someone how knows what he/she is doing will be able to crack it. – Akisame Dec 20 '13 at 14:46
  • "Make it known that their copy is watermarked and if it ends up on a torrent site, they're liable for the lost sales." How much money are you going to ask for if this happens? Millions? They're going to bet their business on someone (disgruntled employee/criminal/the cleaner) not talking a single PC from their office at any point ever? Good luck getting anyone to sign that contract! – user12753 Mar 10 '17 at 16:13
0

Well if you are running a web server people can only access the files broadcast by the server. So this will be one directory and it's subdirectories. You can control access to these files further. Normally a standard server setup does not give access to scripts like PHP as they are run on the server. However, HTML and javascript code are always going to be possible to copy as that is how the web works. You send the HTML to their PC where it is rendered.

  • Thank you very much for your answer. But as my server is placed inside the restaurant, can someone come and clone the entire hard disk then they get everything included my python files? is this concept possible? or can they just go to my server and control it because it is in the restaurant they can just walk into my server and do something with it? or even they get into my server they can't do anything? – Team Dec 20 '13 at 12:42
  • Physical security. The moment someone has physical access to your system, they can do anything. Just lock it up. – Journeyman Geek Dec 20 '13 at 12:54
  • From the setup installation of Ubuntu, you can choose to encrypt the disk. – blade19899 Dec 20 '13 at 12:56
  • if I choose encrypt the disk, even someone can physically get into my server, they can not decrypt it right? and they can not clone my entire server's hard disk? – Team Dec 20 '13 at 13:00
  • 1
    I think you either need to edit the post to be very clear about exactly what you are worried about. i.e. I have software in PHP/flash, on a web server. This is what I am worried people may do. This is what I want them to do. Or take this to a computer security forum. I am starting to get the feeling that this may be a joke and you are just trying to pull me into an endless conversation? – Julian Stirling Dec 20 '13 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.