[ubuntu] How to protect system from cloning?

[floatinteger]

Hello there,

 

I would like to protect a Linux system from cloning, I don't mind if the cloned hard drive works in the same computer, but I need to avoid it to work in other one, even if it uses exactly same mainboard model and rest of computer parts. I want the cloned system to get frozen or simply restart continously if it's used in another computer.

 

I found a thread in other forum that talks about a test of the NIC interface's MAC. It could be a good solution.

 

The issue is that I have no information at all about how to do it, nor the software to use. Of course, I would like it to be as "unbreakable" as possible.

 

Many regards in advance

[localzuk]

Only way you could do this in an "unbreakable" way is via drive encryption, utilising a TPM chip on a motherboard to hold the encryption data. That way, the hard drive only works in a single machine.

 

Other than that, there's no practical way of doing this. Even with a MAC address based check, a user can still spoof the mac address of their card or simply edit the files which are doing the checking.

[floatinteger]

Only way you could do this in an "unbreakable" way is via drive encryption, utilising a TPM chip on a motherboard to hold the encryption data. That way, the hard drive only works in a single machine.

 

Other than that, there's no practical way of doing this. Even with a MAC address based check, a user can still spoof the mac address of their card or simply edit the files which are doing the checking.

 

Many thanks for your answer, localzuk, I really appreciate your time and interest.

 

TPM could be a great solution, but it means adding more hardware since it's not included on motherboard, so it's discard (I need a method that doesn't require special hardware)

 

I can't install a physical lock on the case, neither lock bios or boot menu. The user must be able to use the computer, add new drives or even format hard drive using a tool in a usb drive if he needs. It's even desirable (althought not 100% needed) that user can make a backup of the system disk via cloning, and restoring it when needed. BUT I don't want the user to clone disk and use the operative system and all configurations and programs in a different machine, since it's intended to be used only on this computer (I hope that my explanation is ok, hehe)

 

I know that there is no infallible method for this, but is better having a security method that can be skipped to have no security method at all. If I add some kind of protection, at least the user will have to make some research.

 

I've been reading something about hostid, and if I can tie the operative system to something depending on hardware, it is an important "first step".

 

Many thanks again, I hope someone can lend me a hand.

 

Regards

[pete]

Tie the encryption to a Yubikey.

 

How you handle the customer switching to a new Yubikey after the original one expires without bricking the appliance is your next step.

[LosOjos]

Reading between the lines, it sounds as though you're worried the customer will simply make clones of some setup you have installed rather than paying for additional machines, am I right?

 

If so, I think licensing is the way to go. Far too much time is spent on "DRM" (which it sounds like this is in the realms of), which is never perfect. Draw up a license and if you find they break the terms of that license, then you have legal grounds to take it further.

 

By the same token, if what you have done involves nothing but a setting up FOSS, I'm not sure there's anything you could do if the customer works out how to backwards manufacture that setup, as you don't own any of the software involved.

 

Focus on providing great service rather than crippling DRM and they're more likely to return as customers IMO.

 

PS: I'm not in any way legally trained, this is pure speculation.

Edited September 8, 2014 by LosOjos

[floatinteger]

Many thanks to both for the helping

 

I think encryption is not a solution since the disk can be cloned in raw mode using clonezilla, and installing a yubikey is impossible since the person needs access to the computer if wants to install another disk or something.

 

To now, my only way is as I said, test the tie of the mainboard or hard disk serial, but I don't know hot to, so if someone can help....

 

Thanks

[dhicks]

To now, my only way is as I said, test the tie of the mainboard or hard disk serial, but I don't know hot to, so if someone can help....

 

Culd you just check that the UUID of the main OS disk is present and associated with the file system you expect? You could pretty much just check the output of "ls -l /dev/disk/by-uuid" at startup time, just add a line or two to /etc/rc.local to see if the UUID you expect is present.

[cpjitservices]

You could also set n encrypted LUKS password on the OS itself.

 

https://help.ubuntu.com/community/EncryptedFilesystemHowto3

 

System wont even boot unless the LUKS password is entered.