Re: Secure Linux From Scratch

Along with /tmp, /var, /usr, and /home on their own parittions, it wouldn't be 
difficult to reboot to a read only /. And for people who want it, encrypted 
swap, and/or encrypted /, and /tmp can be mounted either in tmpfs, or 
encrypted. Instructions can all fit on one html page. My system looks like 
this.

Filesystem            Size  Used Avail Use% Mounted on
/dev/hdb1             244M  3.0M  228M   2% /boot
/dev/hdb5             244M   17M  214M   8% /
/dev/hdb6             244M  5.0M  226M   3% /tmp
/dev/hdb7             479M   11M  444M   3% /var
/dev/hdb8             967M  166M  752M  19% /home
/dev/hdb9             967M  629M  290M  69% /home/ashes
/dev/hdb10            967M  138M  780M  16% /tools
/dev/hdb11             15G  4.2G  9.3G  31% /usr
shm                   253M     0  253M   0% /dev/shm

/home, /tmp, and /var should be nosuid, and nodev. Personaly I've never had a 
problem with /var as long as its over 32mb. I have /opt symlinked 
to /usr/opt. /tools needs to be slightly more then 1gig to be able to build 
glibc inside it, 1200MB should be just enough.

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page