O'Reilly - Practical UNIX & Internet Sec... 7015KB

As the superuser, you might also want to sweep through the /tmp directory on a periodic basis and delete any files that are
more than three or five days old:[9]
[9] Beware that this command may be vulnerable to the filename attacks described in Chapter 11.
# find /tmp -mtime +5 -print | xargs rm -rf
This line is a simple addition to your crontab for nightly execution.
25.2.5 Soft Process Limits: Preventing Accidental Denial of Service
Most modern versions of UNIX allow you to set limits on the maximum amount of memory or CPU time a process can
consume, as well as the maximum file size it can create. These limits are handy if you are developing a new program and do
not want to accidentally make the machine very slow or unusable for other people with whom you're sharing.
The Korn shell ulimit and C shell limit commands display the current process limits:
$ ulimit -Sa -H for hard limits, -S for soft limits
time(seconds) unlimited
file(blocks) unlimited
data(kbytes) 2097148 kbytes
stack(kbytes) 8192 kbytes
coredump(blocks) unlimited
nofiles(descriptors) 64
vmemory(kbytes) unlimited
$
These limits have the following meanings:
time
file
[Chapter 25] 25.2 Overload Attacks
data
stack
Maximum number of CPU seconds your process can consume.
Maximum file size that your process can create, reported in 512-byte blocks.
Maximum amount of memory for data space that your process can reference.
Maximum stack your process can consume.
coredump
Maximum size of a core file that your process will write; setting this value to 0 prevents you from writing core files.
nofiles
Number of file descriptors (open files) that your process can have.
vmemory
Total amount of virtual memory your process can consume.
You can also use the ulimit command to change a limit. For example, to prevent any future process you create from writing a
data file longer than 5000 Kilobytes, execute the following command:
$ ulimit -Sf 10000
$ ulimit -Sa
time(seconds) unlimited
file(blocks) 10000
data(kbytes) 2097148 kbytes
stack(kbytes) 8192 kbytes
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch25_02.htm (10 of 11) [2002-04-12 10:44:54]