Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people who do have access to the server in an on-rack (live) and off-rack (turned-off) capacity.
How effective would the following setup be in securing the source code and other sensitive files?
Method of protection:
Presume the application uses the following stack: LEMP + Redis + Node (Websocket)
A. One time config
- Disable autostart of Nginx, Redis and MySQL
- Create a root directory for a RAMDISK partition:
mkdir -p /media/private
- Change MySQL's data directory to
B. After each reboot
- Create and mount a RAMDISK partition:
mount -t tmpfs -o size=2048M tmpfs /media/private/
- Create required sub directories under
- Upload MySQL data files, Nginx config file, SSL cert files, Redis config file, PHP source files, and node app files to the appropriate directory under
- Start Redis server with custom config
- Start MySQL server
- Start Nginx with custom config