> -----Original Message----- > From: centos-bounces at centos.org > [mailto:centos-bounces at centos.org] On Behalf Of Keith Keller > Sent: Saturday, December 12, 2009 9:19 PM > To: CentOS mailing list > Subject: Re: [CentOS] Deleting contents of /tmp on shutdown > > On Sat, Dec 12, 2009 at 07:35:51PM -0500, Thomas Dukes wrote: > > > > Thanks for the link. It's a little over my head though. > > No it isn't. The main thing you need is > > mount -t tmpfs -o size=100M,mode=0755 tmpfs > /var/www/www.example.com/cache > > You would adjust size to be the size of the vmdisk you want, > and adjust /var/www... to be /tmp. If you want this on boot, > put the appropriate entry into /etc/fstab: > > tmpfs /var/www/www.example.com/cache tmpfs size=100M,mode=0755 0 0 > > (same adjustments here) > > > Today, I found upd.pl in my tmp directory. The date was oct 09. I > > also found my /etc/passwd and /etc/shadow had been changed > with a user > > of 0Profile added. I deleted the old files and restored those from > > backup. I ran my chkrootkit and installed mod_security. > SSH is not > > running so I don't know how this happened. > > Perhaps your system is not as simple as you think it is. ;-/ > > --keith Thanks, Keith! Guess I'd better brush up on my vi commands in case I have to boot from a rescue disk. :-) Just guessing here, but to do this, I need to add: tmpfs /tmp tmpfs size=100M,mode=0755 0 0 To my /etc/fstb and cross my fingers?