当前位置: > Linux安全 >

CentOS下逻辑卷的tmp安全设置

时间:2014-02-22 01:25来源:www.it.net.cn 作者:IT网

Centos默认安装无指定分区的时候,逻辑卷没有独立的/tmp 容易造成安全隐患,/dev/shm也是隐患之一

  1. #dd一个1G的文件,文件/.tmpfs

  2. ddif=/dev/zeroof=/.tmpfsbs=1Mcount=1000

  3.  

  4. #创建文件系统

  5. mke2fs -j /.tmpfs

  6.  

  7. ####################

  8. mke2fs 1.41.12 (17-May-2010)

  9. /.tmpfsisnotablockspecialdevice.

  10. Proceedanyway? (y,n)y

  11. Filesystemlabel=

  12. OStype: Linux

  13. Blocksize=4096(log=2)

  14. Fragmentsize=4096(log=2)

  15. Stride=0blocks, Stripewidth=0blocks

  16. 64000inodes, 256000blocks

  17. 12800blocks(5.00%)reservedforthesuperuser

  18. Firstdatablock=0

  19. Maximumfilesystemblocks=264241152

  20. 8blockgroups

  21. 32768blockspergroup, 32768fragmentspergroup

  22. 8000inodespergroup

  23. Superblockbackupsstoredonblocks:

  24. 32768, 98304, 163840, 229376

  25.  

  26. Writinginodetables: done

  27. Creatingjournal(4096blocks): done

  28. Writingsuperblocksandfilesystemaccountinginformation: done

  29.  

  30. Thisfilesystemwillbeautomaticallycheckedevery32mountsor

  31. 180days, whichevercomesfirst.  Usetune2fs -cor -itooverride.

  32. ####################

  33.  

  34. #复制文件

  35. cp -av /tmp /tmp.old

  36.  

  37. #挂载之前dd的文件

  38. mount -oloop,noexec,nosuid,rw /.tmpfs /tmp

  39.  

  40. #赋默认/tmp的权限

  41. chmod1777 /tmp

  42.  

  43. #把刚复制出去的文件移回来

  44. mv -f /tmp.old/* /tmp/

  45.  

  46. #删除文件夹

  47. rm -rf /tmp.old

  48.  

  49.  

  50. #修改/etc/fstab 使它重启后自动挂载

  51. /.tmpfs /tmp ext3 loop,nosuid,noexec,rw 0 0

  52.  

  53. #软链接/var/tmp到/tmp

  54. mv /var/tmp /var/tmp_bak

  55. ln -s /tmp /var/tmp

  56. cp -Rf /var/tmp_bak/* /var/tmp

  57. rm -rf /var/tmp_bak/

  58.  

  59. #测试

  60. #分别到/tmp与/dev/shm目录里,创建可执行文件,并给与777权限

  61. [root@localhost /tmp]

  62. # ls -lA /tmp/|grepx.sh

  63. -rwxrwxrwx1rootroot22Jul2515:08x.sh

  64.  

  65. [root@localhost /tmp]

  66. # cat /tmp/x.sh

  67. #!/bin/bash

  68. echotest

  69.  

  70. [root@localhost /tmp]

  71. # /tmp/x.sh

  72. -bash: /tmp/x.sh: Permissiondenied

  73.  

  74. [root@localhost /dev/shm]

  75. # ls -lA |grep x.sh

  76. -rwxrwxrwx1rootroot22Jul2515:08x.sh

  77.  

  78. [root@localhost /dev/shm]

  79. # cat x.sh

  80. #!/bin/bash

  81. echotest

  82.  

  83. [root@localhost /dev/shm]

  84. # /dev/shm/x.sh

  85. -bash: /dev/shm/x.sh: Permissiondenied

  1. #修改/etc/fstab 改变/dev/shm共享内存的nosuid与noexec值

  2. tmpfs/dev/shmtmpfsdefaults,nosuid,noexec,rw00

  3. mount -oremount /dev/shm/

 

(责任编辑:IT)
------分隔线----------------------------
栏目列表
推荐内容