Skip to main content

Posts

Showing posts from March 21, 2009

Fighting Linux Rootkits

Recently having had an unpleasant experience with a rootkit that was installed in /var/tmp, better security measures were clearly needed.

Unfortunately, /tmp and /var/tmp are world-writable by necessity and are the favorite target of rookit users. It would be nice to have some sort of protection on these directories and the easiest way is to mount a filesystem image using the loopback device and mount it with noexec and nosuid options via /etc/fstab.

Create the file system image, change its permissions with chmod 1777 and keep it in /boot; 1,200,000 512-byte blocks should be a good size and not waste too much disk space for small files. If your needs are different, adjust accordingly.

# dd if=/dev/zero of=/boot/tmp.img bs=512 count=1200000

This produces a disk size of roughly 300M.

The filesystem format chosen for this particular task is Reiserfs because it handles large amounts of smaller files very well. We need to use the -f option because the file is not a block special device. If the…