Date: Mon, 12 Dec 2011 13:00:29 -0700 From: "Eric S Pulley" <pulley@dabus.com> To: freebsd-questions@freebsd.org Subject: Re: 9.0 install and journaling Message-ID: <4989a3ebb7810ed26951cbbd23b7645c.squirrel@webmail.dabus.com> In-Reply-To: <4EE3D1F0.60500@herveybayaustralia.com.au> References: <4EE32BB6.3020105@herveybayaustralia.com.au> <alpine.BSF.2.00.1112100755520.11994@wonkity.com> <4EE38454.3020307@otenet.gr> <4EE3D1F0.60500@herveybayaustralia.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
> > As for one big / partition- linux may be using it: and its their biggest > failing! I've had a system lockup due to lack of space. Never a problem > with bsd as logs will only fill up var, a user won't break it with > filling up usr, etc. And root always stays protected! Its saved my life > a number of times... I can quickly fill TB's of data in no time, and if > something goes bang the logs can be a silent killer too. My 2c's anyway... > _______________________________________________ > And along those lines for security of the system, this is the U.S. DoD recommendations (well mandates really) including ZFS. Not that the DoD doesn’t have security problems... but I’m not big fan of the one or two mount point solution either… never understood why other OS packagers think is okay to just dump it all under / Per the DISA STIG (Security Technical Implementation Guide) / (obviously) /<home directories)> /var /tmp /<location of audit files> should all be separate mount points "The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing"... in addition... All local file systems must employ journaling or another mechanism that ensures file system consistency. Removable media, remote file systems, and any file system that does not contain approved device files must be mounted with the "nodev" option. Removable media, remote file systems, and any file system that does not contain approved setuid files must be mounted with the "nosuid" option. The nosuid option must be enabled on all NFS client mounts. and so on... you can find a copy of the UNIX STIG online and some of it is just crazy paranoia and makes your life a pain, but there are a lot of good practices in it too.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4989a3ebb7810ed26951cbbd23b7645c.squirrel>