ServerBuddies Support Blog

mount your /tmp partition with the noexec,nosuid options, and mount the /home partition with the nosuid option.

t install time, the easiest thing to do is to mount your /tmp partition with the noexec,nosuid options, and mount the /home partition with the nosuid option. This is done in your /etc/fstab and requires those paths to exist as partitions, and not just as subdirectories of /. If you’re unsure, type:

To get a listing of your partitions and their current mounting options. Use google for more information on these mounting options. Be very careful when editing your /etc/fstab, as any errors could prevent your system from starting up. Note that you must not have “nosuid,noexec” for / or /usr, as those partitions have suid binaries normally (su, passwd, etc).

Edit the fstab file vi /etc/fstab and change it depending on your needs. For example:

To read:

nosuid, Meaning do not allow set-user-identifier or set-group-identifier bits to take effect, nodev, do not interpret character or block special devices on this file system partition, noexec, do not allow execution of any binaries on the mounted file system.

Securing the /tmp Partition

It is recommended to create /tmp as separate partition and mount it with the noexec and nosuid options.

The noexec option disables the executable file attribute within an entire file system, effectively preventing any files within that file system from being executed.

The nosuid option disables the SUID file-attribute within an entire file system. This prevents SUID attacks on, say, the /tmp file system.

To secure the /tmp partition of your Parallels Plesk Panel server:

If /tmp is a separate partition on the server, you only need to edit /etc/fstab and add the noexec and nosuid options for /tmp. Then remount the partition.

If the /tmp directory resides on the / partition:

Create a new partition for /tmp, for example with size 512 MB: