Re: Re: Re: Security Uploading Files

[Vautrin]

In regards to checking the amount of disk space left, you may want to partition your hard drive so that files are uploaded on a separate partition. Then, even if someone manages to try to upload a terabyte of data from /dev/urandom, all that gets filled will be your partition, and your computer should still be able to operate.

[beth]

While you're doing that, mount the partition with noexec:

              noexec Do not allow execution of  any  binaries  on
                     the  mounted file system.  This option might
                     be useful for a server that has file systems
                     containing  binaries for architectures other
                     than its own.

Also good for parititions that are writable by untrusted users. It was suggested to me recently that the whole web root should be on a noexec partition, with cgi's symlinked from /usr/lib (or, presumably, other trusted partitions).