Re: *nix partitioning practices
Jon Lewis <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 16 Jun 2009, ISP Lists wrote: >>> Agreed. I'd also point out that having a separate partition for /tmp >>> allows you to set /tmp as noexec which foils a healthy percentage of >>> script kiddie exploit scripts. > > BTW, I really like the noexec on /tmp idea!!!!!!! It won't help as much as you might think. For the past several years, the most common php exploits have been to have bad php code on the server download code from an off-site source (often into /tmp or /var/tmp) and then run it as perl /tmp/a. Perl will happily run the script /tmp/a while /tmp is mounted noexec. I still think it's definitely worth having a /tmp partition (and it should be noexec) on a server, particularly something like a shared web server, but don't expect that noexec to do much for system security. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list