Is an ssh user activity (like processing data never saved to disk) secure from root eavesdropping?

Cygnuson

6/29/24, 2:23 AM

Does a school, business, or friend with root access to a computer have access to currently active process data, like memory contents? How about access to an encrypted fuse mount (while mounted)?

Can disk contents be protected from root while unencrypted?

1 + 3

security

privacy

larsks

6/29/24, 3:14 AM

The `root` user on a system can inspect all memory contents and all mounted filesystems.

larsks

6/29/24, 3:15 AM

Does this answer your question? [restrict root access for certain files or filesystems](https://serverfault.com/questions/473955/restrict-root-access-for-certain-files-or-filesystems)

Jaromanda X

6/29/24, 5:58 AM

I think of it like this. If I am using someone elses computer, don't do or put anything on it I wouldn't want someone else to see.

Score:1

Server

user1686

6/29/24, 8:03 AM

Is an ssh user activity (like processing data never saved to disk) secure from root eavesdropping?

No. Root can trivially make the SSH service log your activity; even without patching the SSH service itself, they could just configure /etc/profile to make your SSH sessions go through script and you probably wouldn't even notice.

Does a school, business, or friend with root access to a computer have access to currently active process data, like memory contents?

Yes. They can literally attach a debugger to any process and use that to examine the program's memory, to trace the system calls it makes, and to inject new code making the program do whatever they want. (Not to mention the various system tracing facilities that work on a more global scope, such as bpftrace.)

How about access to an encrypted fuse mount (while mounted)?

Yes. If the FUSE filesystem daemon limits access by UID, root can just become that UID. If the daemon has some fancier checks, root can attach to any of your processes and monitor data that's being read by that process. Root can also attach a debugger to the filesystem daemon and (with sufficient knowledge) read out the encryption key from memory, or potentially patch out the access checks.

Can disk contents be protected from root while unencrypted?

No. Root can always access the disk's contents (e.g. to run fsck). Unencrypted means root doesn't even have to go through the OS – they can inspect disk contents directly, or they can pull the disk out and connect it to another system. (It's why one encrypts disks, after all.)

Root is the "system owner" account. It's part of root's job to have this kind of access.

+ 1

Cygnuson

6/29/24, 1:29 PM

Thanks for the answer!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is an ssh user activity (like processing data never saved to disk) secure from root eavesdropping?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.