How to Secure /tmp and /var/tmp and /dev/shm on Linux

In a Linux environment, it’s essential to secure temporary directories like /tmp, /var/tmp, and /dev/shm, as they are vulnerable to malicious activity. Securing them helps prevent unauthorized access and the execution of harmful files. In this blog, we’ll guide you on how to secure /tmp, /var/tmp, and /dev/shm on Linux by adjusting partition settings and modifying mount options.

Securing /tmp

The /tmp directory is often used by applications to store temporary files. Here’s how you can secure it:

Step 1: Backup your /etc/fstab file to ensure you have a restore point.

cp /etc/fstab /etc/fstab.back

Step 2: Create a new partition for /tmp:

dd if=/dev/zero of=/var/tempFS bs=1024 count=3072000 
/sbin/mkfs.ext3 /var/tempFS

This command creates a 3GB ext3 filesystem for /tmp. Adjust the size based on your requirements.

Step 3: Backup your current /tmp data.

cp -Rpf /tmp /tmpbackup

The command copies the entire /tmp directory to /tmpbackup, preserving permissions and overwriting existing files.

Step 4: Mount the new partition with proper security settings.

mount -o loop,noexec,nosuid,rw /var/tempFS /tmp 
chmod 1777 /tmp

Step 5: Copy the old data back to the new /tmp partition.

cp -Rpf /tmpbackup/* /tmp/

Step 6: Edit /etc/fstab to make this change permanent.

nano -w /etc/fstab

Add the following line:

/var/tempFS /tmp ext3 loop,nosuid,noexec,rw 0 0

Step 7: Remount /tmp and verify.

mount -o remount /tmp 
df -h

Check if /tmp is properly mounted.

Securing /var/tmp

We can use /tmp as /var/tmp for added security:

Step 1: Move the existing /var/tmp directory.

mv /var/tmp /var/vartmp 
ln -s /tmp /var/tmp

Step 2: Copy any existing data from /var/tmp to the new /tmp.

cp /var/vartmp/* /tmp/

Securing /dev/shm

The /dev/shm directory is used for shared memory, which could be vulnerable if misconfigured.

Step 1: Edit /etc/fstab to secure /dev/shm.

nano -w /etc/fstab

Locate the line for /dev/shm:

none /dev/shm tmpfs defaults,rw 0 0

Change it to:

none /dev/shm tmpfs defaults,nosuid,noexec,rw 0 0

Step 2: Remount /dev/shm.

mount -o remount /dev/shm

Conclusion

By following these steps, you can significantly improve the security of your system’s temporary directories, protecting against unauthorized access and preventing the execution of malicious files in /tmp, /var/tmp, and /dev/shm. Always remember to restart relevant services after making these changes for them to take effect.

If you need assistance to secure /tmp, /var/tmp, and /dev/shm on Linux or require expert Linux server management services, feel free to contact us. Our team is ready to provide tailored solutions to enhance your system’s security and ensure optimal performance. Reach out today for professional support!