1

I am running Ubuntu (14.04) server and I saw this question:

How do I reset a lost administrative password?

I wondered, because my server virtual machine is on the ESXi server, I don't know if anybody having access to them can backup my VM and restore it somewhere and try to access the data stored.

I have no choices for moving VM to a safe server, because my agents forced me to this job.

As I do not trust people who have access to this server, I need to create a shell script and put in /etc/init.d/my_script to remove my data if unauthorized physical access is detected.

Improve this question
2
  • Please see if this gives you the answer security.stackexchange.com/questions/10354/…
    – Krishna Pandey
    Commented Nov 27, 2015 at 15:48
  • If you don't trust the physical device, you can't trust data on it. If you can copy a VM, you can attempt to access the data - having a script delete data does't work, since an attacker can have as many copies as they like. They could run them from read-only media, preventing deletion. Drive encryption won't help - it would have to be decrypted for use, and could be copied at that point. You need to trust the physical machine. See technet.microsoft.com/library/cc722487.aspx - it all still applies
    – Matthew
    Commented Nov 27, 2015 at 16:02

2 Answers 2

Reset to default
2

I need to create a shell script and put in /etc/init.d/my_script to remove my data if unauthorized physical access is detected.

In general, "Having a VM self-destruct if unauthorized physical access is detected on the host system" is almost impossible. Are there other details about your situation, beyond what's already in the question, that would make this problem easier (ie remotely possible)?

In fact, there is a set of industry standards that specifically address the problem of wiping data if physical access is detected. This is the FIPS 140-2 standards which apply to Hardware Security Modules (HSM). In particular, FIPS 140-2 Level 3 and Level 4 deal with detecting intrusion. Devices that meet this spec are purpose-built with specialized hardware to detect intrusion, you will not be able to do this on an arbitrary ESX VM.

Your best bet is A) to buy an HSM (they start at $500 and go up to tens of thousands of dollars) then B) use keys stored on the HSM to encrypt the sensitive data on the VM so that even if someone clones the VM they will not be able to access the data without the HSM being plugged in. As pointed out by @Neil Smithline, even this is defeated by cloning a running VM since the decryption keys and/or the decrypted data will be in memory.

If you really want a simple script-based solution there are some things you can do which will deter casual attackers. But I will not recommend any because they are basically pure security theater and will not stop anybody with even a little bit of hacking training.

Improve this answer
6
  • Hi @Mike Ounsworth, Thanks for your help. These people aren't professional, But I am worried. Now the server collocated in the safe data center. May one day due to relocation to another data center, could access to server. Also access to ESXi.
    – mahyarss
    Commented Nov 27, 2015 at 16:46
  • According to they are not professional. I was thinking for a trick. If i create a shell script, and this script detect something like unknown username. For example: I just connect to my vm via ssh with public key from putty with username 'xuser'. And If someday my vm cloned and login directly with another user then script delete my data. (This people don't know about path and type of my data, and i can put a fake data in partition of vm, after script delete my real data, They only find fake data and happy for this.)
    – mahyarss
    Commented Nov 27, 2015 at 17:06
  • You could do something like that, but I will not tell you that it's ok because this won't protect you at all if you are ever attacked by real hackers.
    – Mike Ounsworth
    Commented Nov 27, 2015 at 17:31
  • Does the HSM help if the VM is cloned while running with keys in memory?
    – Neil Smithline
    Commented Nov 27, 2015 at 17:34
  • @NeilSmithline Fair, I hadn't considered cloning a running VM. That introduces more problems. Though I wouldn't have keys in memory anyway but rather get the HSM to do the decryption for you. Then you have decrypted data in memory so same problem.
    – Mike Ounsworth
    Commented Nov 27, 2015 at 17:36
1

You're trying to solve a fundamentally unsolvable problem. It'd be trivial to clone the machine and you'd never be able to detect it since it's happening outside of the VM. The best you could do is encrypt the partition with your secret data, and manually type in the password each time the server boots. If the password is simply stored on the machine somewhere, obtaining it is as easy as mounting the partition elsewhere and reading the file.

This still won't protect you however if someone has physical access. Since they have physical access to the server as well as VMWare level access, they could simply just scan the memory for the password, clone the machine, and enter the password they obtained from memory scanning.

This would take a little more technical expertise on the attackers part, and would only protect you from anyone that lacks this expertise.

Improve this answer
3
  • I am often connected with ssh (public key) access from putty. with this can scan the memory for the password?
    – mahyarss
    Commented Nov 27, 2015 at 16:26
  • No, if you have ssh keys set up, then the attacker would need your private key which is stored on your client machine, and never shown to the server (hence private key)
    – Mike Ounsworth
    Commented Nov 27, 2015 at 16:29
  • 1
    They can always clone a running VM that has the password entered.
    – Neil Smithline
    Commented Nov 27, 2015 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .