Re: *nix partitioning practices

Jon Lewis <[email protected]>
Newsgroups gmane.org.operators.internet-access
Message-ID <[email protected]>
On Tue, 16 Jun 2009, ISP Lists wrote:

>>> Agreed.  I'd also point out that having a separate partition for /tmp 
>>> allows you to set /tmp as noexec which foils a healthy percentage of 
>>> script kiddie exploit scripts.
>
> BTW, I really like the noexec on /tmp idea!!!!!!!

It won't help as much as you might think.  For the past several years, the 
most common php exploits have been to have bad php code on the server 
download code from an off-site source (often into /tmp or /var/tmp) and 
then run it as perl /tmp/a.  Perl will happily run the script /tmp/a while 
/tmp is mounted noexec.

I still think it's definitely worth having a /tmp partition (and it should 
be noexec) on a server, particularly something like a shared web server, 
but don't expect that noexec to do much for system security.

----------------------------------------------------------------------
  Jon Lewis                   |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.