Question

I’m using twisted to create a server.
Problem is, I must protect my code. Since I don’t want to publish it, I’m not really interess into obfuscation or compilation of the python code.
My problem is, my twisted application must run with root uid and a lot of people have root access to this server.
I don’t care if they can read it, but I want sure they can’t modify it!
What is the best solution, knowing I’m using twisted? I’ve seen in twistd, tapconvert and mktap that twisted can “encrypt” my code, but I didn’t find any good documentation about that.
Anybody to help me?

Thanks in advance for any answer =)
Have a nice day!

/!\ EDIT:
I got another question, I’ve wrote my code following this part of twisted documentation: http://twistedmatrix.com/documents/current/core/howto/application.html so I launch my server using a command like twistd -y server.py –logfile …
Since I’m doing that, I assume I can’t use software like cx_Freeze to hide my code right ?

Answer 1

You have a number of problems here.

my twisted application must run with root uid

This is bad. If there are vulnerabilities in your application, then they will be made more serious by running as root. You should consider finding a way to not run as root. For example, if you only run as root so you can bind to a low numbered port, consider using authbind instead.

a lot of people have root access to this server

Perhaps you should limit privileged access to those people who actually need it. If that isn’t an option, then perhaps you should at least limit access to people you can trust. Someone who has root on a machine can do anything they want on that machine, and defeat any scheme you dream up.

I don’t care if they can read it, but I want sure they can’t modify it!

You should ask them not to modify it, then.

I’ve seen in twistd, tapconvert and mktap that twisted can “encrypt” my code, but I didn’t find any good documentation about that. Anybody to help me?

You shouldn’t bother trying to use the encryption features of twistd and mktap. These don’t prevent anyone from changing your code. At best they might prevent someone from reading some of it. As you said, this isn’t even your goal. Even if it were your goal, someone with root access will be able to decrypt these files easily, so it doesn’t even help there.

If you give code to someone, expect them to be able to do anything and everything they want with it. If you put code on a server, you are effectively giving it to everyone with root access to that server.

So, stop thinking about encryption and other technical issues and think of some other way to achieve your goals – fire the untrustworthy administrators, use an appropriate license on the code, get an actual contract, etc.