0

My company rents a Debian server to the clients, that they have to connect to their own network.

The server provides various services, an administration interface, and connects to the online service of my company.

As the client has access to the computer running these services, he can read their source code on the hard drive. A malicious user can search for security vulnerabilities, and it may help to reverse engineer the online services.

How can I protect the source code from the client?

Edit: The source code is in PHP, and some users have a root account on their servers (soon to be removed)

Improve this question
3
  • there are things you can do to make it difficult, but if they can access the code, they can reverse engineer it, no matter what you do - the solution would be to prevent access to the code/binaries on disk
    – schroeder ♦
    Jun 16, 2017 at 10:30
  • 1
    That is not any different from selling proprietary, closed-source software.
    – Stephane
    Jun 16, 2017 at 10:57
  • security by obscurity is a mistake. you need to make all your code open source. if it's still safe, you're doing it correctly, and peeking behind the curtain won't help eve. otherwise you're lying or mistaken about security.
    – dandavis
    Jun 17, 2017 at 18:10

2 Answers 2

Reset to default
0

I'm not sure why you allow untrusted users root access to server, but the only approaches I can think of is to deny such users access to the directory containing the PHP code.

This can either done by:

  1. Encrypting the directory containing the PHP code and decrypting it on the fly with a key that is obtained from a secure server
  2. Fetching the PHP code from a secure location at boot-up, then caching it in memory and using that
  3. Running the PHP code on a different server that the users don't have access to, fetching data from the shared server (e.g. via NFS) where necessary.

Note that the first two approaches are susceptible to various ways of someone sneaking a look at the code; e.g. by adding an extra PHP file that examines the other PHP files and returns their code content. You might be able to get around that by doing something clever with php-fpm so that the encrypted code is run in a single php-fpm instance and everything else is run in a second, but I wouldn't bet against someone with root access getting around that.

I would go for the third approach myself, as that's the only way to secure it.

Improve this answer
-1

zip your clean copies so a simple fopen won't work, set attributes of read-only on the folders to the libs, run your libs from behind a admin account, set pathways and an environment for each user with set memory and keep tabs on the libs space occupied. Heap allotments for all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .