Hardening /tmp in Plesk

Hardening /tmp location is very important as you may risk running rootkits, ircbots and trojans from that location. Today we had a similar problem with one of our plesk server where these bots were getting uploaded in /tmp location. However there is NO perfect solution to find how these are getting uploaded under /tmp but its better take preventive mesaures for not letting them execute.

Hardening /tmp

Since /tmp was not seperately mounted there is no need to take the backup of /etc/fstab file. However its good to take in case anything goes wrong.

Create a separate partition for /tmp. For that we need to create a separate device with a certain space. The space allocation is actually depending on the apps running on your machine. Here I’m creating a separate device of size 100M and formatting it with ext3 filesystem.

dd if=/dev/zero of=/dev/tmpFS bs=1024 count=100000

mke2fs –j /dev/tmpFS

Copying existing data which is in the /tmp directory to a sperate temporary directory.

cp –pRf  /tmp /tmp_bkp

Mounting the new partition that we’ve created in the /tmp directory and setting the necessary permissions.

mount -o loop,noexec,nosuid,rw /dev/tmpFS /tmp

chmod 1777 /tmp

Copy the old data which is int /tmp_bkp directory to the new /tmp directory.

cp –pRf  /tmp_bkp/* /tmp

Finally add the following entry to the fstab to make the changes permanent.

/dev/tmpFS /tmp ext3 loop,nosuid,noexec,rw 0 0

That’s it. Your /tmp location is secured now.

/tmp 100% full

Today eventually we came across this problem on one of our server. Interestingly there were no files in /tmp folder Even though we have cleard the unwanted files but still /tmp is 100% full.

Here is why it happens.

If you delete files and they don’t go from df -h disk status then you’ve deleted files that are open by processes. You will have to restart whichever processes had those files were open in the first place, typically httpd or mysql.

lsof | grep /tmp

you will get the result as below

httpd 30070 nobody 1975u REG 7,0 0 11 /tmp/ZCUDMmgQDr (deleted)
httpd 30100 nobody 1975u REG 7,0 0 11 /tmp/ZCUDMmgQDr (deleted)
mysqld 7290 mysql 5u REG 7,0 1089 29 /tmp/ibYfnGNC (deleted)
mysqld 7290 mysql 6u REG 7,0 0 30 /tmp/ibgA9zfB (deleted)

kill httpd and mysql or whaterver process it shows that will fix the problem. I hope you all know the command to kill httpd or mysql.

Killall -e -9 httpd or service httpd stop

______________________________________________________________________________
Still having issues with the server ? Please contact us we are 24×7 online to assist you.

Regards,
Admin
http://24×7servermanagement.com/
Email: sales@24×7servermanagement.com
______________________________________________________________________________