3

Is it possible to use some (signing) service from the rpi itself that would allow us to make sure of 2 things?

  • Code is running on a raspberry
  • Code is running on a certain raspberry box and not another (using the serial number and stuff).

I know there's the serial number in /proc/cpuinfo but reading it could be "faked" on a python script by just modifying it and hard-code whatever we wanted on it but if there were some kind of low-level signing service available this hampering could be detected because rpi signature would fail.

My goal is to make sure that messages that reach my server are being generated from a given rpi and not
1 - another rpi or
2 - some other box (a normal x86 PC).
Assume that the boxes can be physically reached by a person... so it's about detecting if someone has copied the content of the SDCard into another computer (an rpi or otherwise) and run my (python) code.

Improve this question
2
  • 1
    your question is not related to Raspberry Pi .... it is related to computer security and software security
    – jsotola
    Commented Jul 2, 2018 at 5:03
  • What is your goal, there may be a better way to do it.
    – ctrl-alt-delor
    Commented Jul 2, 2018 at 22:32

2 Answers 2

Reset to default
2

If the attacker has access to the original hardware (and software), there's nothing you can do about that. Consider your RPi pwned, there are no guarantees at all.

Re: key-signing security device, you may attach one to the USB port, this will guarantee that you're using the RPi (probably not yours) with the same security device attached to USB port.

There are no built-in facilities like that in RPi.

Improve this answer
2
  • Sure.... and right now I'm not worrying for trying to make my device "impossible to break".... I know that's not possible. I'm rather thinking into detecting if another device is trying to make itself look like "my" device from another host, either another rpi or some other kinf of box. Actually, the rpi will connect to a VPN so I'd like to be able to detect to the best I can if a device has been tampered with so that I can disable it from my service if it happens (not make it impossible to hamper it).
    – eftshift0
    Commented Jul 2, 2018 at 3:59
  • @eftshift0 see the update to the answer, please.
    – lenik
    Commented Jul 2, 2018 at 7:51
1

In addition to the answer from @lenik there are some authentication methods. It depends on what service you are using. With ssh you can verify with entries in ~/.ssh/known_hosts. With https you can verify the server certificate. The general but big solution for authentication and authorization is to install a Kerberos server and use Kerberos. With this you are even able to control single services running local or on remote hosts.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.