CISecurity AMI EC2 Amazon

Question

We are moving to Amazon our on-premise infrastructure and I'm trying to follow this document to increase our security of the ec2 instances : CISecurity Benchmark for Amazon Linux

In the document, it's asked to create 6 differents partitions for: - /tmp - /var - /var/tmp - /var/log - /var/log/audit - /home

I mean, the creation of those separate partitions does increase really the security ? Because cost-wise for me it looks like increasing significantly the cost of each instances by adding 6 different EBS volumes for those partitions...

Thanks for your knowledge sharing.

Answer 1

This is a very low-risk threat and you could ignore it in most cases.

That being said, the document explains the rationale behind ensuring that separate partitions exist for each of the mountpoints you specified. Since they are world-writable, you run the risk of resource exhaustion without binding mount points to a separate partition. Additionally, separating partitions allow you to set a noexec flag on mounts that should not contain executables. Finally, it makes resizing on the cloud easier.

Finally, you don't need 6 separate EBS volumes; /tmp could be mounted using ramdisk; you could have multiple partitions for the same physical volume.

Answer 2

Like Jedi said,it is a low-risk threat. You don't need separate volumes as much as separate partitions but with appropriate mount point options (again like Jedi said), noexec or ro for example. I've seen cases where inodes in the root partition were exhausted due to generation of a large number of files and that brought the server down because nothing could be written to disk any longer.

Unless you consider /tmp to be ephemeral (you should), ie. you don't need any of the data in /tmp to persist instance reboots, you should not mount it as a ramdisk.

And there's always LVM.