LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-26-2010, 11:47 AM   #1
steinz
Member
 
Registered: Mar 2006
Posts: 49

Rep: Reputation: 16
tmp filling up with root-tmp diretories


Hi,

My /tmp directory is being filled up with root-tmp.####.

I suspect they are being created by bastille-tmpdir-defense.sh, but they do not seem to get removed. Anyone know why?



Thanks
Randy
 
Old 04-26-2010, 11:56 AM   #2
EricTRA
Guru
 
Registered: May 2009
Location: Gibraltar, Gibraltar
Distribution: Fedora 18 with Awesome WM
Posts: 6,805
Blog Entries: 1

Rep: Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290
Hello,

What distro are you using? Not that it's that important since logrotate exists in most (if not all) Linux distros. That being said, do you have those logs rotated with logrotate? That's a great way to automatically clean up 'old' logs. If you're only generating logs, without doing some housecleaning then it's quite normal your /tmp is filling up.

Kind regards,

Eric
 
Old 04-26-2010, 01:18 PM   #3
steinz
Member
 
Registered: Mar 2006
Posts: 49

Original Poster
Rep: Reputation: 16
I am running RHEL 4 update 7
 
Old 04-26-2010, 01:28 PM   #4
EricTRA
Guru
 
Registered: May 2009
Location: Gibraltar, Gibraltar
Distribution: Fedora 18 with Awesome WM
Posts: 6,805
Blog Entries: 1

Rep: Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290
Hi,

And did you set up logrotate to rotate the logs of the application you think is filling up your /tmp?

Kind regards,

Eric
 
Old 04-26-2010, 01:33 PM   #5
steinz
Member
 
Registered: Mar 2006
Posts: 49

Original Poster
Rep: Reputation: 16
I do not think these are logs, I think Bastille is creating a private /tmp location for any user that requires the use of /tmp. It is for my own security.
 
Old 04-26-2010, 01:46 PM   #6
EricTRA
Guru
 
Registered: May 2009
Location: Gibraltar, Gibraltar
Distribution: Fedora 18 with Awesome WM
Posts: 6,805
Blog Entries: 1

Rep: Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290
Hi,

I'm sorry, I'm completely on the wrong track here. That happens when trying to multitask an old brain. Sorry for that.

I looked some things up in Google and found that when running:
Code:
bastille -c
you are at a certain point presented the choice:
Code:
Would you like to install TMPDIR/TMP scripts? ->
Did you set that by any chance to Y (yes)? Could you reconfigure bastille and set it to N (no) to see if that makes a difference? Apparently according to a howto on HowToForge the preferred setting is N for this particular option.

I don't know nor have any experience with Bastille, so just offering ideas.

Kind regards,

Eric
 
Old 04-27-2010, 08:28 AM   #7
steinz
Member
 
Registered: Mar 2006
Posts: 49

Original Poster
Rep: Reputation: 16
thanks, I think your right, I did set Would you like to install TMPDIR/TMP scripts? to YES.
But I might just try to delete /etc/profile.d/bastille-tmpdir-defense.sh, rather than reinstall Bastille.

Randy
 
Old 04-27-2010, 08:34 AM   #8
EricTRA
Guru
 
Registered: May 2009
Location: Gibraltar, Gibraltar
Distribution: Fedora 18 with Awesome WM
Posts: 6,805
Blog Entries: 1

Rep: Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290Reputation: 1290
Hi,

OK, I hope it works out. Please let us know if it does.

Kind regards,

Eric
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't login, says tmp directory full but tmp file is empty! Could be linked to MySQL? bethanlowder Fedora 7 09-25-2009 07:17 AM
how to securing /tmp , /var/tmp and /dev/shm hackintosh Linux - Security 7 10-17-2007 11:26 PM
/tmp filling up with logwatch stefaandk Linux - General 2 06-06-2006 07:36 PM
/tmp filling up Randux Slackware 16 03-14-2006 06:54 PM
Newbie question - /tmp /var/tmp Mr happy Linux - Security 3 01-27-2003 01:03 PM


All times are GMT -5. The time now is 12:17 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration