http://admin0.info/articles/security/
1) tmp on second drive
2) create tmp DIRECTORY
3) solution script to check the existing tmp dir and delete
4) locking down compilers w/000
a) so, what i am seeking is input. there have been issues with RedHat 9.0, dual xeon systems with dual scsi.
b) will locking down comiplers as listed in #4 have any effect with SiteStudio or other prgms.
so, read and lets see if we can get direct answers..
*******************************
1) On the 2nd scsi drive, make the /tmp
say /dev/sdbX
mke2fs on the /dev/sdbx ENTER
mount /dev/sdbx /mnt/backup ENTER
cp -a /tmp/* /mnt/backup/ ENTER
pico /etc/fstab
add
/dev/sdbx
mv /tmp /tmp-old
REBOOT
*************************************************
2)
First, make a backup copy of your fstab.
cp /etc/fstab /etc/fstab.original
so that if something goes wrong, you have a backup copy to start your system
Now, let's get started.
Almost 95% of the exploits found freely in the internet, that I got my hands on, target /tmp as an ideal place to write/compile exploits, and recently some new exploits target /var/tmp.
Assuming we already have a server with dedicated partitions, we will now provide /tmp and /var/tmp partition to our cpanel system without having the need to create partitions. We simply create a file, and mount it as a filesystem. In case you have a different hard disk, you can create physical partitions and dedicated it to /tmp and /var/tmp. In my servers, I have used a 100Mb size. In some busy servers that I look after, I had to increase the size from 100 MB => 500 MB depending on the need of the system. Below example is a 100MB size.
warning: some of the commands below are destructive. please understand what you are doing. you should not play with /etc/fstab or with the following commands unless you understand what you are doing.
cd /dev/
dd if=/dev/zero of=Tmp bs=1024 count=100000
dd if=/dev/zero of=varTmp bs=1024 count=100000
mkfs -t ext3 /dev/Tmp
mkfs -t ext3 /dev/varTmp
confirm
This command will create /dev/Tmp and /dev/varTmp files, each 100Mb in size, and the mkfs command will format those files in ext3 format, so that we are able to use it. If you need a bigger size than 100 MB, please pass that using count=xxx for example, for 500MB, use "bs=1024 count=500000"
cd /
cp -aR /tmp /tmp_backup
mount -o loop,noexec,nosuid,rw /dev/Tmp /tmp
cp -aR /tmp_backup/* /tmp/
chmod 0777 /tmp
chmod +t /tmp
cd /var/
cp -aR /var/tmp /var/tmp_backup
mount -o loop,noexec,nosuid,rw /dev/varTmp /var/tmp
cp -aR /var/tmp_backup/* /var/tmp/
chmod 0777 /var/tmp
chmod +t /var/tmp
run the command
df -h
which will show something like below at the last 2 lines of the output.
/dev/Tmp 95M 4.4M 86M 5% /tmp
/dev/varTmp 95M 4.1M 86M 5% /var/tmp
cd /tmp/ ; ls -al
and
cd /var/tmp/ ; ls -al
to ensure that all files are there. Try restarting apache and mysql just to check that they will work without problems.
/scripts/restartsrv httpd
/scripts/restartsrv mysql
****************************************************
3)
Since you are not able to make a secure /tmp partition now, for a crude solution, you can do
-------------
#!/bin/sh
while true
do
sleep 30s
cd /tmp
rm -f *.c
done
-----------
and run that script in the background as
./script > /dev/null 2>&1 ENTER
what that script does is, it will check your /tmp partition every 30 seconds and delete any *.c files that it finds, while sending all output and error messages to /dev/null
******************************
4)
cd /usr/bin/
chmod 000 perlcc byacc yacc bcc kgcc cc gcc i386*cc
chmod 000 *c++ *g++
chmod 000 /usr/lib/bcc /usr/lib/bcc/bcc-cc1
if exists,
chmod 000 /usr/i386-glibc21-linux/lib/gcc-lib/i386-redhat-linux/2.96/cc1
That will disable compiler access for all users.
Before upgrading apache or php; or if you need to install a programme, enter the following command to enable compiler access for the root user.
chmod 700 /usr/bin/cc
chmod 700 /usr/bin/gcc
In a cPanel system, you need access to the compiler when upgrading apache or installing vps/jsp etc.
after upgrading apache via /scripts/easyapache, disable the compiler again.
chmod 000 /usr/bin/cc
chmod 000 /usr/bin/gcc
4 4
