How to secure an embedded linux image

Question

I'm building an image with openwrt sdk and i want to secure my image (by encrypting filesystem for example).. How can i do that to prevent anyone from seeing my sscripts or programs running ?

Answer 1

Don't give anybody physical access to a device that's running your image. If they have physical access to the device, they can read your image. Encryption wouldn't do any good since the decryption key would have to be readable.

If the device has some tamper-resistant storage such as a TPM or a smart card, this raises the bar somewhat: someone who wants to read your image would have to snoop on some data bus (which requires a bit of equipment). But still, if the device can run it, so can anyone who is physically present.

Obviously, the image should be secured during transport. But since the transport is between locations that you control (from your development machine to the physically secured device), this shouldn't be a problem.

Don't give anyone shell access to the device. You can get away with a sufficiently restricted shell access (no administrative powers), but really, on a WRT system, there's nothing to warrant that.