4 ms·
May I add a very general tip for web servers? Mount /tmp on its own volume and set the noexec mount flag. I've seen too many old php apps fall due to files upl
by INTPenis 10y ago
May I add a very general tip for web servers? Mount /tmp on its own volume and set the noexec mount flag.
I've seen too many old php apps fall due to files uploaded and executed from /tmp. Bulletin boards, blogs, but this was all 8 years ago.
- AdmiralAsshat 10y agoNever occurred to me to do this. That's actually a great idea.
- falcolas 10y agoGood tip. If you'll excuse me, I'm going to go make a Jira ticket now...
- jlgaddis 10y agonodev,noexec,nosuid is how I've mounted /tmp (and several others) for going on two decades. I've never been a fan of installers creating a single partition by default and I wish they didn't do it. Years ago, like you, I saw an out-of-date web app get hit by an exploit but was "saved" because of some of those mount options. I'm a big fan of SELinux on public-facing servers too (especially web servers, for the same reason), but that's an argument for another day.
- INTPenis 10y agoI wanted to add nosuid too but I kept it simple, thanks for adding your own two cents. Edit: Also a big fan of SElinux, high five!