Re: Attempts to push spam through apache

>
> The previous intruder, which I suspect was an automated script and not a
> real person, never got root.  The script installed the IRC proxy source in
> /tmp, then compiled and ran it as the apache user.   After that happened, I
> blocked apache's access to /tmp by creating  a "tmpusers" group to which
> apache doesn't belong, and making /tmp owned by root/tmpusers with 0770
> perms.  I don't have to support users on this box, so only a limited number
> of users, like the PostgreSQL owner, need access to /tmp.  I was already
> routing other things apache commonly puts in /tmp like PHP session data to
> separate directories so this was a pretty simple fix.
>
> Thanks again!
>
> Peter

You could also mount /tmp on another partition with the "noexec" option.
(in fstab .... defaults,noexec,rw)
Usualy 100-200M will do.