I have spent a lot of time on researching on this topic but I haven't found any working solution for my problem respectively I'm not clear about some points.
My goal is to distribute a encrypted/copy-protected Raspberry Pi LAMP server (for offline/local network use only) to my clients.
It should not be possible to copy the system so the question is, how can I make the project safe against manipulation and copying?
I thought about these options:
LUKS and TPM (and TrustedGrub/secure boot?). Is it possible to copy/clone a TPM chip and the content of the SD card to break the protection? Are there any ready-to-use Pi modules for this method?
LUKS and YubiKey NEO - Is it possible to use the key just to store the decryption key without two factor so the device can start itself?
OpenPGP smartcard? Could this solve my problem to store encryption keys and copy protection? Is it possible to clone the OpenPGP cards, and/or what about the newer USB version?
What about cryptocape for BeagleBone? Is this an example that I would need? If true, does something like this exist for Raspberry?
Any other ideas?
The goal is clearly that no one should be able to access the filesystem of this device to modify or leak content.
Even if I find a working scheme, what about protection against evil maid attack regarding the open/boot on LUKS?
Finally, how to protect the device from people making a RAM dump and capturing the decryption keys? Is any implementation or method available that doesn't store the keys in RAM? Is a good epoxy on the RAM maybe the only solution for this issue?
I will be really happy for help on this.
There is no need to speak about other attack vectors like weak SSH passwords, SQL injection or another other stuff.