0

My company rents a Debian server to the clients, that they have to connect to their own network.

The server provides various services, an administration interface, and connects to the online service of my company.

As the client has access to the computer running these services, he can read their source code on the hard drive. A malicious user can search for security vulnerabilities, and it may help to reverse engineer the online services.

How can I protect the source code from the client?

Edit: The source code is in PHP, and some users have a root account on their servers (soon to be removed)

  • there are things you can do to make it difficult, but if they can access the code, they can reverse engineer it, no matter what you do - the solution would be to prevent access to the code/binaries on disk – schroeder Jun 16 '17 at 10:30
  • why do they have root access to the box? – schroeder Jun 16 '17 at 10:31
  • 1
    That is not any different from selling proprietary, closed-source software. – Stephane Jun 16 '17 at 10:57
  • I forgot to mention that the code is in PHP (not compiled program). + @schroeder makes me remind that some client have a root account on the box... – tux lu Jun 16 '17 at 12:08
  • security by obscurity is a mistake. you need to make all your code open source. if it's still safe, you're doing it correctly, and peeking behind the curtain won't help eve. otherwise you're lying or mistaken about security. – dandavis Jun 17 '17 at 18:10
0

I'm not sure why you allow untrusted users root access to server, but the only approaches I can think of is to deny such users access to the directory containing the PHP code.

This can either done by:

  1. Encrypting the directory containing the PHP code and decrypting it on the fly with a key that is obtained from a secure server
  2. Fetching the PHP code from a secure location at boot-up, then caching it in memory and using that
  3. Running the PHP code on a different server that the users don't have access to, fetching data from the shared server (e.g. via NFS) where necessary.

Note that the first two approaches are susceptible to various ways of someone sneaking a look at the code; e.g. by adding an extra PHP file that examines the other PHP files and returns their code content. You might be able to get around that by doing something clever with php-fpm so that the encrypted code is run in a single php-fpm instance and everything else is run in a second, but I wouldn't bet against someone with root access getting around that.

I would go for the third approach myself, as that's the only way to secure it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.