Create /tmp partition as noexec or /scripts/securetmp

[webignition]

I'm configuring a new CentOS 3.4 server at the moment and would like some advice on how best to secure /tmp.

Partitioning has already been performed by the DC, so I don't have the opportunity of creating a separate partition for /tmp - currently there is just a /tmp directory.

I've read an article at http://www.eth0.us/?q=tmp regarding securing /tmp, specifically mentioning how one can create a partition for /tmp if one does not already exist.

What I'd first like to know are peoples' opinions on how safe it would be to proceed with the instructions within the article at http://www.eth0.us/?q=tmp regarding creating a new partition and mounting it as /tmp.

Secondly, what I would like to know is whether I'm better off trying to create a new partiion for /tmp or simply running /scripts/securetmp to secure what is currently in place. Is running /scripts/securetmp to secure my existing /tmp directory sufficient, or would I really be better off creating a partition for /tmp as explained in the above mentioned article?

 

[chirpy]

Running /scripts/securetmp pretty much does the same thing as that article. If you like to do things yourself, go with the article. While you're in /etc/fstab you can add ,noexec,nosuid to /dev/shm too and umount and mount that.

 

[Blue|Fusion]

Just wondering, because I did all mine manually, too, but how do you bind /var/tmp on /tmp in /etc/fstab? Can it be done?

 

[StevenC]

/my/real/dir /to/mount/dir ext3 rw,bind 0 0

 

[webignition]

Thanks Chirpy. I'll proceed with following the article and see what happens - I'm not going to learn any other way! Since no accounts have been moved to this new server yet I've got nothing to lose.

One other question: the article suggests 190MB for the tmp partition. Is this a reasonable size? I was also thinking that 190MB is rather specific - does it need to be precisely this? Why not 200MB? Is there a reason for 190MB, or just simply the author's preference?

 

[chirpy]

Just wondering, because I did all mine manually, too, but how do you bind /var/tmp on /tmp in /etc/fstab? Can it be done?

It's easier to simply delete /var/tmp and then:

ln -s /tmp /var/tmp

 

[chirpy]

Is there a reason for 190MB, or just simply the author's preference?

The latter. you can make it any size that you want. Bearing in mind it's only meant to be for temporary data, it'd be a waste to make it too big.