Nuxified GNU/Linux Help Forums - Tip collection - Comments

Security tip with /tmp

sakuramboo — Mon, 07 Jul 2008 06:12:24 +0200

This tip about security deals with the /tmp directory. /tmp is used for certain file execution (such as installing third party .run or .bin installation files), any temporary file storage, such as office documents and any downloaded files that were selected to open in a program as apposed to saving to disk. Unfortunately, by default, /tmp allows for all execution, meaning, if a script was to be placed in /tmp, another program or script could access that script to execute arbitrary code, in turn, opening up your system to a local attack. This tip is for how to jail off /tmp from allowing the execution of code and how to allow it in instances when needed.

The first thing that the user must do is to create a separate partition for the /tmp directory. I usually will use the same ideology that the swap partition gets for /tmp, in that I will allocate twice the amount of space as to the total amount of physical RAM I have installed. For systems with a limited amount of hard disk space, a smaller amount may be used, but do not make it too small that would, in turn, not have enough space for any tasks you might be doing.

After making the partition for /tmp, you will need to edit the /etc/fstab file to make it resemble the following...

/dev/sda5 /tmp auto rw,noexec 0 0

Mileage may vary with the usage of the proper devices. Now, this will disallow any code/script/program from executing from the /tmp directory. However, as I mentioned before, some programs do require /tmp to be mounted executable. In those instances, a simple mount command would fix this issue...

mount -o remount,exec /tmp

And upon completion of the program...

mount -o remount,noexec /tmp

That will bring back the /tmp directory to a noexec status.

Cool, maybe it's best to

libervisco — Thu, 18 May 2006 21:00:12 +0200

Cool, maybe it's best to make a special blog entry in a tips category that links to this thread so that these tips aren't lost, and then move on from there.

Then this thread can be locked and it's original and last post edited with the link to the new tips section.

Good idea

a thing — Thu, 18 May 2006 20:49:52 +0200

I like it

Tips to blog

libervisco — Thu, 18 May 2006 20:46:52 +0200

I think it would be a good idea to post tips in a blog instead in a forum, from now on. The only requirement to make it organized would be to type "tips" tag in a categories section of your blog submission and then it would automatically be listed on a page with all other tips that would be linked from the main horizontal menu.

In a blogs view I think they'd look better than in a long forum thread and every tip would be possible to comment and discuss on specifically, possibly leading to some new related tips.

What do you think? Shall we continue tips there? If yes, just please remember to type "tips" in a category section of your blog submission.

Thank you

fish kioslave

a thing — Thu, 18 May 2006 20:46:20 +0200

The fish kioslave is like sshfs, but easier. First you have to have ssh set up. Now you can use fish from any KDE application. Just enter fish://USER@HOST/file/name/on/the/host/ (note: You can't use ~ instead of a home directory here) as the filepath and enter your SSH password in the dialog. I use this to manipulate my website from Quanta on my PC, using fish://www@marvin/var/www/.

Executing commands after their predecessor failed

dylunio — Wed, 05 Apr 2006 21:42:49 +0200

To execute a command only if the previous command doesn't succeed use ||

emerge --sync || echo "Error in syncing"

If the emerge --sync doesn't work the echo command will be invoked.

Executing multiple commands that depend on their predecessor

reptiler — Sat, 01 Apr 2006 03:26:55 +0200

To execute multiple commands which need their preceeding command executed successfully seperate them with &&
Example:
./configure && make && make install
make will only be started when configure had no error and make install will only be run if there was no error during compilation.

Multiple commands on the same line

a thing — Fri, 31 Mar 2006 23:45:04 +0200

Put multiple commands on the same line by separating them with a semicolon ( ; ).

Multivolume tar archives

a thing — Fri, 31 Mar 2006 22:13:03 +0200

Tar has builtin support for multivolume archives. To create them:
tar -cML (size of drive you're using in KB) -f /place/device/is/mounted/(name of archive).tar (files to be archived)

When tar prompts you to prepare for the next device, umount the device you're saving the archive to (and wait until it finishes, don't Ctrl+C it!) and take it out. Take the device to some other computer (perferably not a windows-running one, windows mounts things sync) and copy the part of the archive on the device to the computer's hard drive. Go back to the computer you're backing up, mount the device, go to tar and hit enter. Repeat until tar finishes.

To extract this multivolume archive:
tar -xMf (part 1 of archive) -f (part 2 of archive) and on for the rest of the parts

Customize your Bash prompt

a thing — Fri, 31 Mar 2006 22:12:38 +0200

Customize your Bash prompt:
http://www.gnu.org/software/bash/manual/bashref#SEC83

Great Bash reference

a thing — Fri, 31 Mar 2006 22:12:15 +0200

Great reference for Bash scripting and other Bash things:
http://www.gnu.org/software/bash/manual/bashref.html

Finding size of a directory

a thing — Fri, 31 Mar 2006 22:11:53 +0200

Space a directory uses:
du -s

Coloring ls'ed files

a thing — Fri, 31 Mar 2006 22:11:24 +0200

For coloring files depending on their type, put this in /etc/profile:
alias ls="ls --color=always"

Human readable filesizes

a thing — Fri, 31 Mar 2006 22:10:56 +0200

For human readable filesizes put this in /etc/profile:
alias ls="ls -h"
alias du="du -h"
alias df="df -h"

Starting out with Vim

dylunio — Sun, 26 Mar 2006 22:41:43 +0200

Starting out with Vim

If you want to use the Vim editor, don't just barge in and try to use it, firlstly go through the Vim tutor: vimtutor

dylunio

Tip collection

a thing — Tue, 31 Jan 2006 06:17:15 +0100

Put your GNU/Linux tips here
Be sure to put a descriptive title when making your post, and only put one tip per post so the box on the frontpage works well.