1

I have to prepare a computer to give away, and I do not know who is going to use it. The computer has Debian installed, and the HDD is entirely encrypted. All users have their storage on the server. I have been believing that if it meet some conditions below this will safe huge works for all computer departments:

  1. Anyone can power on/off computer as they wish

  2. Only permitted users can use installed applications

  3. Permitted Users can not view any configuration files, modify, store data and copy the HDD content even when they remove it to another computer

  4. The HDD only works with the given computer. When it stolen or tap, it is automatic destroy all data inside.

How can I go about doing that?

Improve this question

2 Answers 2

Reset to default
3

It's not really possible. You simply can not prevent someone powering on/off a computer, or indeed them doing whatever they want with it once they have hands on access.

I've done something similar, for a server. It uses full disk encryption and produces its key based on hardware data such as CPU type, Mac Address, amount of memory installed, etc. If someone just took the disk out and placed it in another machine, a different key would be produced and as such the system would not reveal its data. It's meant as a protection when someone exchanges the disk in the data center and puts it in someone else's server without wiping it first.

Still you have to be aware that it does not really protect against someone who wants to mess with your stuff.

Improve this answer
2
  • I like the idea; do you mind revealing details on how it is implemented? My guess: A boot+ramdisk that checks the details and produces a key used for encryption/decryption of the system partition... Commented Jul 29, 2014 at 7:28
  • It's a Custom Initramfs that essentially does cat or grep /proc/ or /sys/ ... | sha512sum | cryptsetup luksOpen .... You'll have to decide for yourself what to use, any variable changes and the key becomes invalid. Have a backup passphrase for maintenance. For stuff like Mac Addresses to become accessible, the kernel needs the network driver in Initramfs stage. Commented Jul 29, 2014 at 11:21
3

  1. Use sudo. (But power off should not be prevented or people will pull the plug instead.)

  2. Some config files can be tightened to the point where they cannot be viewed; however others (critically DNS configuration) do not work if not world-readable. For each file you have to read the manual to find out.

  3. If full disk encryption + TPM-provided boot password doesn't cut it, you need custom hardware which by virtue of being custom stops most attempts.

Improve this answer
2
  • 1-Kindly give me one example of "Some config files can be tightened to the point where they cannot be viewed". 2. Are there any special folders containing configuration files otherthan ordinary folder in the hard disks. Commented Aug 2, 2014 at 21:27
  • 1: /etc/udev is safe, where /etc/resolv.conf and /etc/passwd must be world readable. General rule: for a config file to apply to programs running as a user, that user must be able to read the file. 2: /run but chmod there doesn't persist so you have to stick chmod in the startup scripts. Commented Aug 3, 2014 at 3:59

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.