1

We have a VPS / Bare-metal server rented on a data-center and we access them over internet through user ID and password. It is running CentOS 7. That is direct access and there's no VPN in between. We access GNOME desktop environment directly through VNC client/Nomachine client. The VPS/Bare-metal has VNC-server and NX-server running.

We want to have a secure environment for outsiders to work so that -

a) Nobody can copy code from inside desktop environment (vim or other editor) to outside client machine.

b) There's no internet access from insider VPS, so that a code can't be copied over to internet.

c) SSH is disabled (This is achieved) Of course for root/su users, the SSH and internet access is open.

Is there a way we can achieve this with VNC and IPTABLES etc. Plz note the direct inbound VNC access over internet to be intact. We don't own/rent any other machine on same LAN through which we can route traffic.

The idea is to block here direct code copy from a text editor or bulk transfer through net. HOwever as long as somebody is working on a shared screen they can still screen capture run OCR or at least take it through a mobile phone etc device and run image to text. The point is making things difficult than having 1K/10K/100K/1M lines of code copied just like that.

SS891
  • 71
  • 1
  • 4
  • easiest way to do that is to make your subcontractor sign an NDA. Try to consult to your legal department first. – mforsetti Dec 23 '20 at 16:20
  • How do you plan to do this without the developers revolting? – Michael Hampton Dec 23 '20 at 21:30
  • Ha :-). Nobody revolts. Big techs based in Silicon Valley does exactly same thing. We have worked in such env. Engineers will be worried if they can't download patch or a library of a tool fast to get their job done OR if the desktop is slow. That support will be provided or they can access a sudo account to install tools if any (most of chip design tools are stand-alone and well covered up, not open sourced). We will make sure VNC/Nomachine or other desktop env is fast enough. – SS891 Dec 26 '20 at 08:46

0 Answers0