How to secure your tmp file Print

  • 0

in your fstab, mount your shm as so:
cd /dev/shm/
pico /etc/fstab
none /dev/shm tmpfs rw,noexec,nosuid,nodev 0 0
then umount and remount to take effect without restarting and chmod to 1777
umount /dev/shm
mount /dev/shm
chmod 1777 /tmp
mount -a
Let's open up /scripts/securetmp in your favorite editor:
nano /scripts/securetmp
First, we're going to modify line 49:
my $auto = 1
If this isn't already set to 1, set it. Just makes things easier. Next, let's set the /tmp size, line 148:
my $tmpdsksize = 2097152;
This size is in KB - 2GB aught to do it. Now, to fix the issue of mounting /tmp, line 289:
system 'mount', '-o', $mountkeyword . ',loop,noexec,nosuid', $tmpmnt, '/tmp';
We're adding "loop," to the options passed to the mount command to ensure that the system understands /tmp is a loopback device being created on /usr/tmpDSK. Save and exit your file.
Next, we need to shut off anything using /tmp:
/etc/init.d/mysql stop
/etc/init.d/httpd stop
And unmount it and /var/tmp:
umount /tmp
umount /var/tmp
If you get errors, retry a few times, it'll usually unmount after the 2nd or 3rd try. If you're still getting errors, make sure nothing is open in /tmp:
lsof | grep /tmp
Shut it down or delete it. Next, we need to remove the existing /tmp partition file:
rm -f /usr/tmpDSK
And finally, create the new device:
/scripts/securetmp
Depending on the size of your partition, this may take up to 15-20 minutes. After you're done, start everything back up and ensure /tmp is mounted and the right size with a simple:
df -h

Removing files in /tmp

Yes, you can delete the sess files from the /tmp folder by using,

# cd /tmp

# rm -rf sess_*
rm /tmp/*
restart mysql
* To restart mysql server
service mysql restart (stop)(start)

touch horde.log
but before using this command, make sure that you are in the /tmp directory.

You may need to use a command called tmpwatch which removes files which haven?t been accessed for a period of time. Normally, it?s used to clean up directories which are used for temporary holding space such as /tmp.

Following code will remove all files/dirs from /tmp if they are not accessed in last 2 weeks (24 * 14 days = 336)
tmpwatch --mtime --all 336 /tmp

Setting up a cron job for /tmp/
crontab -e
0 0 * * * rm -rf /var/tmp/*
Running it at 6AM in the mornings:
Instead of 0 0, use 0 6:
0 6 * * * rm -rf /var/tmp/*
If you don't want the output or errors emailed to the owner of this cron job every time it runs, Just discard them as follows:
0 6 * * * rm -rf /var/tmp/* 1> /dev/null 2>&1
No need, just leave them as it is. Those 5-stars tell when to run the command.

General syntax of user crontab line is:
* * * * * command-to-run
1st * represents minutes (0-59)
2nd * - hours (0-23)
3rd * - day of month (1-31)
4th * - month of year (1-12)
5th * - weekday (0,7 for sun, 1 for mon ...)
Pls refer to the man page of crontab (command: man 5 crontab) at the shell prompt of your server to get more information.

+++++++++++++++++++++++++++
This will cover securing /tmp /var/tmp and /dev/shm Secure /tmp:

Step 1: Backup your /etc/fstab file

Code:
cp /etc/fstab /etc/fstab.bak Step 2: Make a 3GB file for /tmp parition and an ext3 filesystem for tmp:

Code:
dd if=/dev/zero of=/var/tempFS bs=1024 count=3072000 /sbin/mkfs.ext3 /var/tempFS *Change the count= to something higher if you need more space*
Step 3: Create a backup copy of your current /tmp drive:

Code:
cp -Rpf /tmp /tmpbackup Step 4: Mount our new tmp parition and change permissions:

Code:
mount -o loop,noexec,nosuid,rw /var/tempFS /tmp chmod 1777 /tmp Step 5: Copy the old data:

Code:
cp -Rpf /tmpbackup/* /tmp/ * If your /tmp was empty earlier, you might get this error : cp: cannot stat `/tmp.bak/*?: No such file or directory
Step 6: Edit /etc/fstab and add this:

Code:
pico -w /etc/fstab And ADD this line:

Code:
/var/tempFS /tmp ext3 loop,nosuid,noexec,rw 0 0 Step 7: Test your fstab entry:

Code:
mount -o remount /tmp Step 8: Verify that your /tmp mount is working:

Code:
df -h Should look something like this:

Code:
/var/tempFS 962M 18M 896M 2% /tmp


Secure /var/tmp:

Step 1: Use /tmp as /var/tmp.


Code:
mv /var/tmp /var/vartmp ln -s /tmp /var/tmp Step 2: Copy the old data back

Code:
cp /var/vartmp/* /tmp/ * If your /var/tmp was empty earlier, you might get this error : cp: cannot stat `/var/vartmp/*?: No such file or directory

Secure /dev/shm:

Step 1: Edit your /etc/fstab:

Code:
pico -w /etc/fstab Locate:

Code:
none /dev/shm tmpfs defaults,rw 0 0 Change it to:

Code:
none /dev/shm tmpfs defaults,nosuid,noexec,rw 0 0 Step 2: Remount /dev/shm:

Code:
mount -o remount /dev/shm
You should restart services that uses /tmp partition

Was this answer helpful?

« Back