0

I am building a simple LAMP that records factory automation data and serves that info locally to tablets and PC's via wifi. I have it set to boot-up automatically when power is applied and log-in automatically to start Apache and MySql. All of that works great.

My problem is that, after the auto log-in, the WWW directory is exposed and anyone can view and modify those php & html files.

How do I set the WWW directory permissions such that Apache works, but you can't view or modify these files?

To say it another way: I am giving my customer the physical computer box, but don't want them to view or modify my web programming.

Any help is greatly appreciated.

IndustrialRick
  • 1

2 Answers2

0

I've covered something similar here before but it's never enough. It only takes somebody with physical access a small amount of knowhow expertise to get root and get access to your files. You can take a few steps to make that as hard as possible though:

  • Why does the system need to auto-login at all? The default settings for the lamp-server task launch the LAMP servers in the background. There's no system access other than by httpd. You don't need to "log in" for those to fire off and if you've somehow cocked things around so that you are logging in as a particular user to launch a web server, you're doing it wrong.

  • Next up, if you do need a desktop user, why does that have to be the same person as the user running the web server (www-data by default)? Simply keep them separate and make sure your files' permissions aren't too open. Something like sudo chmod 750 /var/www/ should be enough to stop others reading.

  • Cripple Grub to remove recovery mode.

  • Password lock BIOS (usually won't protect against a BIOS/CMOS reset)

  • Hot-glue the CMOS battery in and cover the CMOS reset jumpers

  • Melt the SATA cable into the disk and motherboard using a soldering iron or tons of glue.

  • Obfuscate and watermark your files on each deployment so that if they do get nicked you can trace it back to one client so that you can sue them.

  • Physical access restrictions are important too.

  • Perhaps most importantly, if you're going to deploy your software somewhere, make sure the person it's going to knows they are responsible for its safety. I sounds weird but it's not uncommon. Have a contract with them that outlines their liabilities if their copy of your code is leaked out.

Do all that and it might take somebody good about ten minutes longer to work out how to get access to the files. That's mostly the time to warm up glue to remove it.

If you don't want them to ever get access, don't give them the files. Host it yourself and provide it as a service that a lightweight daemon (you write) communicates with.

Community
  • 1
Oli
  • 293,335
  • Thank you for the answer Oli and Fih - I am new to Linux (thank you windows 8) - I didn't know Apache would start without the auto log-in. Just eliminating that should do the trick for me. I'm not worried about the customers hacking - I just want to protect from average dorks fooling around with my code. A hacker good enough to get past the passwords could just program this thing from scratch its not rocket science. If I need more protection, I will just buy a fanless PC and pot the entire box in thermal conductive epoxy :) – IndustrialRick Apr 01 '14 at 18:33
0

In addition to Oli above

If you don't want to mess up your motherboard and disks. You can buy solid tower case with build in physical lock and then glue watermark to the case so you will see if the case was opened (watermark will be torn).

Fih
  • 1,933