Re: File layout?

<quote who=3D"Joe Brault">

> My question is, how does everyone set up
> they're file systems?  Do u have /home on a separate partition, and
> /usr on a separate one, or everything on one partition?  What would
> be the best from a security standpoint?  I've seen it done alot of
> different ways, and wanted to get input from all the folks here.
> Thanks for your time :)

Joe;

Personally I find it a good idea to seperate user data (/home, generally)
from  OS data.  If you have a system with an active spool (mail, news,
print server, for example) then you might want a seperate /var.  It's
valuable to seperate /boot from the other file systems if you mount it
noauto so that you only have it mounted when you want to change it and
therefore mount it.

My personal systems are partitioned generally as

/
/boot
/home
/usr/local

with some possibly having a /var filesystem or a /var/spool filesystem
(/var/spool/mqueue would be good on a system sending lots of mail, for
example)

In general, keeping the partitioning scheme simple is easier to
administer, which is one of the basic tenets of security IMHO.

For trying to lock down a system really well, you want to make as many
systems as you can read-only.  To do this, /var _must_ be a seperate
filesystem, as must any other filesystem you want writeable.  It's a lot
of work to make it a viable rig, though - it's up to you to decide whethe=
r
that is really valuable to you.  In practice, I don't find it worth it,
even generally on a firewall system.

There are lots of folks' opinions on partition schemes out there - read a
few of them and try to decide who you agree with.

Randy