Re: Linux hardening

On Mon, Aug 22, 2005 at 01:49:25PM -0400, Sean Finkel wrote:
> I would recommend also securing /tmp (and /var/tmp). Mounting it noexec 
> and nosuid is a good step to take. As well, I modified my local wget and 
> curl programs to *not* download to /tmp or /var/tmp, as no legitimate 
> use for the program (on my servers) will be downloading files to these 
> locations. As well, these two programs are commonly used in web script 
> attacks to retrieve a remote file and execute it.
> 
> As well, install and run regularly (via cron) chkrootkit and rootkit 
> hunter. You should not rely solely on these programs, but they provide a 
> nice check that can assist you in finding some of the more common and 
> known intrusions/rootkits.

Don't forget /dev/shm too, or wherever your OS happens to mount it.  3+
months ago I recall seeing a seemingly automated compromise that moved
to /dev/shm after the attack using /tmp and /var/tmp failed. 

As an attacker, there are other ways to try and subvert these
protections.  There is no reason an attacker cannot `find / -type
d -perm -o=rwx` prior to download and executing their tool of choice.

I'm also a fan of mounting most partitions 'nodev' too.  If you've
already gone through the effort of mounting them 'noxec,nosuid', 'nodev'
should be a consideration too.

-jon