Centos servers / tmp & / dev / shm Security

Discussion in 'Security' started by sendemi, Aug 18, 2010.

  1. #1
    Step 1: Securing /tmp
    Step 1.1: Backup your fstab file

    cp /etc/fstab /etc/fstab.bak


    Step 1.2: Creating tmpmnt partition file (Around 1Gb in size)

    cd /var
    dd if=/dev/zero of=tmpMnt bs=1024 count=1048576


    Step 1.3: Format the new partition

    mkfs.ext3 -j /var/tmpMnt

    Press Y when asked
    Step 1.4: Making backup of old /tmp

    cp -Rp /tmp /tmp_backup


    Step 1.5: Mount the tmp filesystem

    mount -o loop,noexec,nosuid,rw /var/tmpMnt /tmp


    Step 1.6: Set the right permissions

    chmod 0777 /tmp


    Step 1.7: Copy the files back to new tmp folder

    cp -Rp /tmp_backup/* /tmp/


    Step 1.8: Adding new /tmp filesystem to fstab

    echo “/var/tmpMnt /tmp ext3 loop,rw,noexec,nosuid,nodev 0 0″ >> /etc/fstab


    Step 2: No need for 2 tmp filesystems, so we symlink /var/tmp to /tmp

    rm -rf /var/tmp/
    ln -s /tmp/ /var/tmp


    Step 3: Securing /dev/shm

    nano -w /etc/fstab


    Remove the tmpfs /dev/shm line, and replace it with this:

    none /dev/shm tmpfs rw,noexec,nosuid,nodev 0 0


    Step 4: Double Check your fstab, it should look like this:

    /dev/VolGroup00/LogVol00 / ext3 defaults 1 1
    LABEL=/boot /boot ext3 defaults 1 2
    devpts /dev/pts devpts gid=5,mode=620 0 0
    none /var/shm tmpMnt rw,noexec,nosuid,nodev 0 0
    proc /proc proc defaults 0 0
    sysfs /sys sysfs defaults 0 0
    /dev/VolGroup00/LogVol01 swap swap defaults 0 0
    /var/tmpMnt /tmp ext3 loop,rw,noexec,nosuid,nodev 0 0


    Check for duplicates etc, anything that may be wrong.
     
    sendemi, Aug 18, 2010 IP
  2. CaNeRiuM

    CaNeRiuM Peon

    Messages:
    10
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    thanks information
     
    CaNeRiuM, Aug 27, 2010 IP
  3. admindiary.com

    admindiary.com Peon

    Messages:
    7
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Thank you for this info
     
    admindiary.com, Aug 31, 2010 IP