[1488] in linux-security and linux-alert archive
[linux-alert] Re: More sendmail problems... Partition your disks!
daemon@ATHENA.MIT.EDU (Paul Wouters)
Mon Mar 24 19:14:12 1997
From: Paul Wouters <paul@ns.via.nl>
To: linux-alert@redhat.com
Date: Tue, 25 Mar 1997 00:36:46 +0100 (GMT+0100)
In-Reply-To: <199703241904.OAA18962@ding.mailhub.com> from "Alexander O. Yuriev" at Mar 24, 97 02:04:08 pm
Resent-From: linux-alert@redhat.com
Reply-To: linux-alert@redhat.com
> would say that the following layout is a good place to start:
>
> /
> /usr (nosuid,nodev,ro)
This will break your mailers, uucp stuff, vi preserve, and /
usr/sbin/sendmail !!
It will also prevent you from using /usr/tmp for sockets.
And it will kill bsd Rtools (no problem) and ssh (you might have
ssh in /usr/local, but you'll have the same problem)
> /usr/local (nosuid,nodev,ro)
> /usr/local/sbin (nodev,ro)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Mod: Put all the suid stuff there and symlink it. I have not thought about
sockets though, I have to admit that... but devices and sockets should not
use the same squash options - alex]
See above for some programs.
> /tmp (nosuid,noexec,nodev)
This will make sure we can't use sockets.
> /var (nosuid,noexec,nodev)
> /opt (nosuid,nodev,ro)
> /services (nosuid,noexec,nodev)
> /home (nosuid,nodev)
Paul
