2

Is it possible to use some (signing) service from the rpi itself that would allow us to make sure of 2 things?

  • Code is running on a raspberry
  • Code is running on a certain raspberry box and not another (using the serial number and stuff).

I know there's the serial number in /proc/cpuinfo but reading it could be "faked" on a python script by just modifying it and hard-code whatever we wanted on it but if there were some kind of low-level signing service available this hampering could be detected because rpi signature would fail.

My goal is to make sure that messages that reach my server are being generated from a given rpi and not
1 - another rpi or
2 - some other box (a normal x86 PC).
Assume that the boxes can be physically reached by a person... so it's about detecting if someone has copied the content of the SDCard into another computer (an rpi or otherwise) and run my (python) code.

  • 1
    your question is not related to Raspberry Pi .... it is related to computer security and software security – jsotola Jul 2 '18 at 5:03
  • What is your goal, there may be a better way to do it. – ctrl-alt-delor Jul 2 '18 at 22:32
1

If the attacker has access to the original hardware (and software), there's nothing you can do about that. Consider your RPi pwned, there are no guarantees at all.

Re: key-signing security device, you may attach one to the USB port, this will guarantee that you're using the RPi (probably not yours) with the same security device attached to USB port.

There are no built-in facilities like that in RPi.

  • Sure.... and right now I'm not worrying for trying to make my device "impossible to break".... I know that's not possible. I'm rather thinking into detecting if another device is trying to make itself look like "my" device from another host, either another rpi or some other kinf of box. Actually, the rpi will connect to a VPN so I'd like to be able to detect to the best I can if a device has been tampered with so that I can disable it from my service if it happens (not make it impossible to hamper it). – eftshift0 Jul 2 '18 at 3:59
  • @eftshift0 see the update to the answer, please. – lenik Jul 2 '18 at 7:51
0

In addition to the answer from @lenik there are some authentication methods. It depends on what service you are using. With ssh you can verify with entries in ~/.ssh/known_hosts. With https you can verify the server certificate. The general but big solution for authentication and authorization is to install a Kerberos server and use Kerberos. With this you are even able to control single services running local or on remote hosts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.