Managing Systems and Workgroups: A Guide for HP-UX System Administrators

Administering a System: Managing System Security
Guidelines for Running a Secure System
Chapter 8 779
• Auditing is not enabled automatically when you have recovered the
system. Be sure to turn auditing on.
Guidelines for Mounting and Unmounting a File
System
The mount command enables you to attach removable file systems and
disk or disk partitions to an existing file tree. The mount command uses a
file called /etc/fstab, which contains a list of available file systems and
their corresponding mount positions. The /etc/fstab file should be
writable only by root, but readable by others. Refer to “Managing File
Systems” on page 602 for more information on mounting file systems.
Observe the following precautions when mounting a file system or disk:
• Create a mount point directory (such as /mnt) on which to mount a
new file system. Never mount a file system in a directory that
already contains files, because those files will become inaccessible.
The mount point of a mounted file system acquires the permissions
and ownership of the file system’s root directory.
• Use base mode permissions and access control list entries on disk
path names to control access to disks.
• Use the -r option of the mount command to mount the file system as
read-only. Physically write-protected file systems must be mounted
this way.
• When mounting a new or foreign file system, assume that the
medium is insecure.
❏ Create a directory restricted to root, by setting its permissions
at 700 (drwx------).
# mkdir /securefile
# chmod 700 /securefile
❏ Run the fsck program to verify that the file system is not
technically corrupted.
Make sure that your PATH environment variable does not include
“.” (the current directory); otherwise, you might run a Trojan
Horse version of ls or some similar command while examining
the new file system.