On 24/07/05, Raj Mathur <[EMAIL PROTECTED]> wrote: > 2. Keep /tmp in a separate partition and set the noexec flag on it. > Most (all?) Linux rootkits install through creating a file in /tmp, > compiling it and running it from there itself. noexec /tmp and they > go away looking foolish muttering ``Curses! Foiled again!'' under > their breath.
There is usually a /var/tmp (and sometimes a /usr/tmp) with same permissions as /tmp. A configurable rootkit will try /var/tmp if it is unsuccessful in using /tmp :) If I remember my FHS, /tmp is for temporary stuff that needn't survive a reboot, and /var/tmp is for stuff that needs to survive a reboot. Binand ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click _______________________________________________ linux-india-help mailing list linux-india-help@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-india-help
