Create /tmp partition as noexec or /scripts/securetmp

webignition

Well-Known Member
Jan 22, 2005
1,876
1
166
I'm configuring a new CentOS 3.4 server at the moment and would like some advice on how best to secure /tmp.

Partitioning has already been performed by the DC, so I don't have the opportunity of creating a separate partition for /tmp - currently there is just a /tmp directory.

I've read an article at http://www.eth0.us/?q=tmp regarding securing /tmp, specifically mentioning how one can create a partition for /tmp if one does not already exist.

What I'd first like to know are peoples' opinions on how safe it would be to proceed with the instructions within the article at http://www.eth0.us/?q=tmp regarding creating a new partition and mounting it as /tmp.

Secondly, what I would like to know is whether I'm better off trying to create a new partiion for /tmp or simply running /scripts/securetmp to secure what is currently in place. Is running /scripts/securetmp to secure my existing /tmp directory sufficient, or would I really be better off creating a partition for /tmp as explained in the above mentioned article?
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,437
33
473
Go on, have a guess
Running /scripts/securetmp pretty much does the same thing as that article. If you like to do things yourself, go with the article. While you're in /etc/fstab you can add ,noexec,nosuid to /dev/shm too and umount and mount that.
 

StevenC

Well-Known Member
Jan 1, 2004
252
0
166
/my/real/dir /to/mount/dir ext3 rw,bind 0 0
 

webignition

Well-Known Member
Jan 22, 2005
1,876
1
166
Thanks Chirpy. I'll proceed with following the article and see what happens - I'm not going to learn any other way! Since no accounts have been moved to this new server yet I've got nothing to lose.

One other question: the article suggests 190MB for the tmp partition. Is this a reasonable size? I was also thinking that 190MB is rather specific - does it need to be precisely this? Why not 200MB? Is there a reason for 190MB, or just simply the author's preference?
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,437
33
473
Go on, have a guess
Blue|Fusion said:
Just wondering, because I did all mine manually, too, but how do you bind /var/tmp on /tmp in /etc/fstab? Can it be done?
It's easier to simply delete /var/tmp and then:

ln -s /tmp /var/tmp
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,437
33
473
Go on, have a guess
webignition said:
Is there a reason for 190MB, or just simply the author's preference?
The latter. you can make it any size that you want. Bearing in mind it's only meant to be for temporary data, it'd be a waste to make it too big.