how to make sure that some code is working on a rpi?

Question

Is it possible to use some (signing) service from the rpi itself that would allow us to make sure of 2 things?

• Code is running on a raspberry
• Code is running on a certain raspberry box and not another (using the serial number and stuff).

I know there's the serial number in /proc/cpuinfo but reading it could be "faked" on a python script by just modifying it and hard-code whatever we wanted on it but if there were some kind of low-level signing service available this hampering could be detected because rpi signature would fail.

My goal is to make sure that messages that reach my server are being generated from a given rpi and not
1 - another rpi or
2 - some other box (a normal x86 PC).
Assume that the boxes can be physically reached by a person... so it's about detecting if someone has copied the content of the SDCard into another computer (an rpi or otherwise) and run my (python) code.

Answer 1

If the attacker has access to the original hardware (and software), there's nothing you can do about that. Consider your RPi pwned, there are no guarantees at all.

Re: key-signing security device, you may attach one to the USB port, this will guarantee that you're using the RPi (probably not yours) with the same security device attached to USB port.

There are no built-in facilities like that in RPi.

Answer 2

In addition to the answer from @lenik there are some authentication methods. It depends on what service you are using. With ssh you can verify with entries in ~/.ssh/known_hosts. With https you can verify the server certificate. The general but big solution for authentication and authorization is to install a Kerberos server and use Kerberos. With this you are even able to control single services running local or on remote hosts.