The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Create /tmp partition as noexec or /scripts/securetmp

Discussion in 'General Discussion' started by webignition, Apr 18, 2005.

  1. webignition

    webignition Well-Known Member

    Joined:
    Jan 22, 2005
    Messages:
    1,880
    Likes Received:
    0
    Trophy Points:
    36
    I'm configuring a new CentOS 3.4 server at the moment and would like some advice on how best to secure /tmp.

    Partitioning has already been performed by the DC, so I don't have the opportunity of creating a separate partition for /tmp - currently there is just a /tmp directory.

    I've read an article at http://www.eth0.us/?q=tmp regarding securing /tmp, specifically mentioning how one can create a partition for /tmp if one does not already exist.

    What I'd first like to know are peoples' opinions on how safe it would be to proceed with the instructions within the article at http://www.eth0.us/?q=tmp regarding creating a new partition and mounting it as /tmp.

    Secondly, what I would like to know is whether I'm better off trying to create a new partiion for /tmp or simply running /scripts/securetmp to secure what is currently in place. Is running /scripts/securetmp to secure my existing /tmp directory sufficient, or would I really be better off creating a partition for /tmp as explained in the above mentioned article?
     
  2. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Running /scripts/securetmp pretty much does the same thing as that article. If you like to do things yourself, go with the article. While you're in /etc/fstab you can add ,noexec,nosuid to /dev/shm too and umount and mount that.
     
  3. Blue|Fusion

    Blue|Fusion Well-Known Member

    Joined:
    Sep 12, 2004
    Messages:
    378
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Cleveland, Ohio
    Just wondering, because I did all mine manually, too, but how do you bind /var/tmp on /tmp in /etc/fstab? Can it be done?
     
  4. StevenC

    StevenC Well-Known Member

    Joined:
    Jan 1, 2004
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    16
    /my/real/dir /to/mount/dir ext3 rw,bind 0 0
     
  5. webignition

    webignition Well-Known Member

    Joined:
    Jan 22, 2005
    Messages:
    1,880
    Likes Received:
    0
    Trophy Points:
    36
    Thanks Chirpy. I'll proceed with following the article and see what happens - I'm not going to learn any other way! Since no accounts have been moved to this new server yet I've got nothing to lose.

    One other question: the article suggests 190MB for the tmp partition. Is this a reasonable size? I was also thinking that 190MB is rather specific - does it need to be precisely this? Why not 200MB? Is there a reason for 190MB, or just simply the author's preference?
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    It's easier to simply delete /var/tmp and then:

    ln -s /tmp /var/tmp
     
  7. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    The latter. you can make it any size that you want. Bearing in mind it's only meant to be for temporary data, it'd be a waste to make it too big.
     
Loading...

Share This Page