Securing /tmp and shm partitions

Securing /tmp and /dev/shm is a nice practice.  Lots of programs and scripts have access in there. So you don’t want code, malicious or not to run in there, trying to get root permissions or snoop on you.

Temporary storage directories such as /tmp, /var/tmp and /dev/shm provide storage space for malicious executables.
Crackers and hackers store executables in /tmp. Malicious users can use temporary storage directories to execute unwanted program and crack your server.

First because I forget, let’s bind /var/tmp to /tmp in /etc/fstab

Now we deal with /tmp only.

Update 28/03/2015: That practice was for many unstable and criticized also by many. Unfortunately for them, I was vindicated when even OpenBSD in the upcoming version does the same for the very same reasons. Security.

Security improvements:

  • /var/tmp is now a symbolic link to /tmp, as a first step towards reducing the “fill it up” attack surface against the /var partition.

 

If it’s a separate partition we only need a

If it’s not, we will create an image for it. The example is for 4GB, tune it as you like.

Modify /tmp line as follows:

You should to the same for shm:

 

Edit your /etc/fstab:
# nano /etc/fstab

change:
“none /dev/shm tmpfs defaults,rw 0 0” to
“none /dev/shm tmpfs defaults,nosuid,noexec,rw 0 0”

Remount /dev/shm:
# mount -o remount /dev/shm
It should be fine now.

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
YUM CRON Enabling automatic updates in Centos 7 and RHEL 7
Viewed 12067 times since Fri, Oct 26, 2018
12 Linux Rsync Options in Linux Explained
Viewed 12192 times since Wed, Oct 31, 2018
Install Security Patches or Updates Automatically on CentOS and RHEL
Viewed 1938 times since Fri, Oct 26, 2018
ZFS: Snapshots and clones on zfs filesystems
Viewed 3219 times since Sun, Jun 3, 2018
SSH Essentials: Working with SSH Servers, Clients, and Keys
Viewed 4644 times since Wed, Jun 27, 2018
SYS: Configure a local repository. local repo
Viewed 11133 times since Mon, Oct 29, 2018
RHEL: Route network packets to go out via the same interface they came in
Viewed 3271 times since Sat, Jun 2, 2018
Moving SSL Certificate from IIS to Apache
Viewed 2131 times since Mon, Feb 18, 2019
RHEL: Bonding network interfaces
Viewed 3854 times since Sat, Jun 2, 2018
How to disable SSH cipher/ MAC algorithms for Linux and Unix
Viewed 47595 times since Fri, Aug 21, 2020