3

Pretend I have a server. Is there anyway to prevent (or make more difficult) the administrator from taking snapshots? Feel free to give me a software way, or suggest if I should change server types; dedicated server be better than a VPS, or KVM VPS be better than an OpenVZ VPS?

I know certain countries have laws, but I have trust issues. I am also aware that it is possible to dump the RAM and find the decryption key (in the event that the VPS is encrypted).

Thanks!

1 Answer 1

1

If you have a VPS the administrator of the underlying computer system can easily do snapshots and you cannot prevent this from inside the VPS. Similar you cannot prevent snapshots of a process by somebody having administrative access to the underlying operating system.

The only way to protect sensitive data inside a process/VM is to obfuscate them in order to make it harder to extract information from the snapshot. Better yet don't even have any sensitive data inside the process/VM, that is do your sensitive computations on a system where only you have control like done with Cloudflare Keyless SSL. Or use hardware where nobody except you have access, but even in this case somebody might have tampered with the hardware or it might backdoors inside by design.

3
  • Thanks. When you say obfuscate do you mean source codes, or something else? Sadly I can't host from my own hardware - it must be from a dedi or VPS. Nov 5, 2015 at 21:26
  • Sorry to double post but I'm unsure how Cloudfare's keyless SSL would help me, struggling to understand the technology. Nov 5, 2015 at 21:35
  • @user5510281: With keyless SSL the private key is not on-site and can thus not be extracted when a VPS snapshot is done. Instead the necessary cryptographic operations are done off-site at a remote system and the private key is only there. This is in a way similar to smart cards or other hardware security modules where the private key is also not accessible by the computer. And with obfuscate I mean whatever you can obfuscate - if the secret is plain in some PHP file you must obfuscate it, if it is at some location in memory you must obfuscate it there etc - easy to say but hard to do. Nov 5, 2015 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .