/etc/fstab & nosuid

[Tim O'Connell]

I am currently "hardening" my HPUX11 server and one of the recommendations is to prevent programs with the SUID bit set being run in certain partitions (Obviously I won't remove it from root, tmp etc).One of my current vfstab entries looks like:
/dev/vg01/lvol5 /u05 vxfs delaylog 0 2

Can I simply replace delaylog with nosuid & unmount & mount or do I need to leave delaylog,nosuid there or is there a better way.

Rgds,

Tim

[Mark Grant · Accepted solution]

I'd leave the delaylog there myself. Otherwise, yes, just remount it with the new options.

[G. Vrijhoeven]

Hi Tim,

First I would not include / some commands need the suid bits.
Otherwise leave deleylog and add ,nosuid this works.
You can remount all filesystems online e.g.:

mount -o remount,nosuid /tmp

HTH,

Gideon

[Bill Hassell]

nosuid should be on *EVERY* mountpoint except / /usr /opt. That is especially true for /tmp, /var and /home as these are directories where users have write privileges. This is also important for database directories which should never have executables. I would also look carefully at database mountpoints that have wide open (777) permissions as this is not only a security risk (anyone can read the raw data) but anyone can trash the data.

[Tim O'Connell]

Thanks for the help. Points awarded

Rgds,

Tim

[Doug Burton]

Here's (basically) what we use...
/dev/vg00/lvol3 / vxfs defaults 0 1
/dev/vg00/lvol1 /stand hfs defaults,nosuid 0 1
/dev/vg00/lvol5 /home vxfs defaults,nosuid 0 2
/dev/vg00/lvol6 /opt vxfs defaults 0 2
/dev/vg00/lvol7 /tmp vxfs defaults,nosuid 0 2
/dev/vg00/lvol8 /usr vxfs defaults 0 2
/dev/vg00/lvol4 /var vxfs defaults,nosuid 0 2
/dev/vg00/lvol9 /var/adm/crash vxfs delaylog,nosuid 0 2