Secure /tmp And /var/tmp Directories On CentOS Linux

A couple days ago a CentOS Linux server that I took over administration on had some mysterious files show up in the /tmp and /var/tmp directories. The files were placed in /tmp and /var/tmp by the apache user meaning there is some form of security hole in Apache, PHP, or one of the virtual hosts has an insecure application installed. Before looking into where the issue is I needed to lock things down so no applications could be executed from these directories in the future regardless of a security flaw in the future. Below are instructions on how to secure /tmp and /var/tmp.

Secure /tmp Directory On Linux:

1. Generate 1GB File: Make sure that you have enough space on your hard drive using the df (df -kh) command. Then generate a one gigabyte file that will be used for the /tmp directory using the syntax below.
   bash

   
   

   1. [root@dev ~]# dd if=/dev/zero of=/dev/tmpDIR bs=1024 count=1000000
   2. 1000000+0 records in
   3. 1000000+0 records out
   4. 1024000000 bytes (1.0 GB) copied, 5.32903 seconds, 192 MB/s

   As you can see in the above output it took the server 5.3 seconds to generate the 1GB file which will be used for both /tmp and /var/tmp once we are completed.

2. Format File To EXT3: After the file is created you will need to format the file to ext3 or whatever filesystem you are using for the other directories on the Linux server using syntax similar to the below. The output is included below so you know that when the “Proceed anyway?” warning displays that you should type “y” for yes followed by enter to continue.
   bash

   
   

   1. [root@dev ~]# /sbin/mkfs.ext3 /dev/tmpDIR
   2. mke2fs 1.39 (29-May-2006)
   3. /dev/tmpDIR is not a block special device.
   4. Proceed anyway? (y,n) y
   5. Filesystem label=
   6. OS type: Linux
   7. Block size=4096 (log=2)
   8. Fragment size=4096 (log=2)
   9. 125184 inodes, 250000 blocks
   10. 12500 blocks (5.00%) reserved for the super user
   11. First data block=0
   12. Maximum filesystem blocks=260046848
   13. 8 block groups
   14. 32768 blocks per group, 32768 fragments per group
   15. 15648 inodes per group
   16. Superblock backups stored on blocks:
   17.         32768, 98304, 163840, 229376
   18.  
   19. Writing inode tables: done
   20. Creating journal (4096 blocks): done
   21. Writing superblocks and filesystem accounting information: done
   22.  
   23. This filesystem will be automatically checked every 24 mounts or
   24. 180 days, whichever comes first.  Use tune2fs -c or -i to override.
   25. [root@dev ~]#
3. Backup Current /tmp Directory: Now backup the current /tmp directory using the syntax below which will keep the same permissions for the files currently in /tmp.
   bash

   
   

   1. [root@dev ~]# cp -Rpf /tmp /tmpbak
4. Mount New /tmp Directory: After backing up the data you can proceed with mounting the new /tmp directory with the syntax below.
   bash

   
   

   1. [root@dev ~]# mount -o loop,noexec,nosuid,rw /dev/tmpDIR /tmp

   Notice we are mounting the /tmp directory with noexec and nosuid which will stop direct execution of binary files and not allow set-user-identifier or set-group-identifier bits to take effect respectively.

5. Modify /tmp Directory Permissions: Use the syntax below to modify the permissions of the new /tmp directory on the CentOS Linux server.
   bash

   
   

   1. [root@dev ~]# chmod 1777 /tmp
6. Copy Old /tmp Data: After the directory is mounted and the proper permissions are set you should copy the data from the old /tmp directory into the newly created /tmp directory. First cd into the /tmpbak directory and then copy all of the contents using the syntax below.
   bash

   
   

   1. [root@dev ~]# cd /tmpbak
   2. [root@dev ~]#
   3. [root@dev ~]# cp -Rpf * /tmp/

   You may also need to run the same command again but instead of using just * use .* which will copy files beginning with a dot.

7. Modify fstab: After verifying that the new /tmp directory is working properly you should add a line to the end of the /etc/fstab file so the new directory is mounted when the server reboots.
   bash

   
   

   1. /dev/tmpDIR              /tmp                    ext3    loop,nosuid,noexec,rw 0 0

After finishing the above steps you should now test the /tmp directory to verify it is secure by copying an executable to /tmp and attempt to execute it. Once verified you should also follow the steps below to secure /var/tmp which can also be abused and cause issues on your server.

Secure /var/tmp On A CentOS Linux Server:

1. Temporarily Move /var/tmp: Move the /var/tmp directory to a new location so you can create a symlink to the /tmp directory we already secured.
   bash

   
   

   1. [root@dev ~]# mv /var/tmp /var/tmpbak
2. Create A Symbolic Link: Once the directory has been moved you can now create a symbolic link to the /tmp directory using the syntax below. This will make /var/tmp the same as /tmp while keeping the path integrity.
   bash

   
   

   1. [root@dev ~]# ln -s /tmp /var/tmp
3. Copy /var/tmp Contents: Once the symbolic link is generated you should copy the contents of the /var/tmpbak directory to /var/tmp using the syntax below.
   bash

   
   

   1. [root@dev ~]# cp -pR /var/tmpbak/* /tmp

   Make sure to verify all of the contents of the directory make it to the new directory.

Your /tmp and /var/tmp directories are now secured on your CentOS Linux server.