Securing /tmp and shm partitions

Securing /tmp and /dev/shm is a nice practice.  Lots of programs and scripts have access in there. So you don’t want code, malicious or not to run in there, trying to get root permissions or snoop on you.

Temporary storage directories such as /tmp, /var/tmp and /dev/shm provide storage space for malicious executables.
Crackers and hackers store executables in /tmp. Malicious users can use temporary storage directories to execute unwanted program and crack your server.

First because I forget, let’s bind /var/tmp to /tmp in /etc/fstab

Now we deal with /tmp only.

Update 28/03/2015: That practice was for many unstable and criticized also by many. Unfortunately for them, I was vindicated when even OpenBSD in the upcoming version does the same for the very same reasons. Security.

Security improvements:

  • /var/tmp is now a symbolic link to /tmp, as a first step towards reducing the “fill it up” attack surface against the /var partition.

 

If it’s a separate partition we only need a

If it’s not, we will create an image for it. The example is for 4GB, tune it as you like.

Modify /tmp line as follows:

You should to the same for shm:

 

Edit your /etc/fstab:
# nano /etc/fstab

change:
“none /dev/shm tmpfs defaults,rw 0 0” to
“none /dev/shm tmpfs defaults,nosuid,noexec,rw 0 0”

Remount /dev/shm:
# mount -o remount /dev/shm
It should be fine now.

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
bash mistakes This page is a compilation of common mistakes made by bash users. Each example is flawed in some way.
Viewed 7782 times since Sun, Dec 6, 2020
SSH ProxyCommand example: Going through one host to reach another server
Viewed 11451 times since Tue, Aug 6, 2019
How To Run Multiple SSH Command On Remote Machine And Exit Safely
Viewed 1928 times since Tue, Aug 6, 2019
Top 25 Best Linux Performance Monitoring and Debugging Tools
Viewed 4835 times since Sun, Sep 30, 2018
systemctl Use systemd to Start a Linux Service at Boot
Viewed 4389 times since Mon, Dec 7, 2020
Split and Reassemble files
Viewed 2719 times since Mon, May 28, 2018
LUKS dm-crypt/Device encryption GUIDE
Viewed 1412 times since Fri, Jul 13, 2018
How to recover error - Audit error: dispatch err (pipe full) event lost
Viewed 16635 times since Tue, Aug 6, 2019
RHEL: Services basic management - systemd
Viewed 16924 times since Sat, Jun 2, 2018
haproxy linux
Viewed 1545 times since Sun, Dec 6, 2020