OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: /var filled up and can't login locally or remotely

From: Nick Holland (nickholland-consulting.net)
Date: Wed May 10 2006 - 21:40:50 CDT


Tobias Ulmer wrote:
> On Wed, May 10, 2006 at 10:50:14AM -0300, Giancarlo Razzolini wrote:
>> Paul de Weerd wrote:
>>
>>> Don't change root's shell.
>>>
>>>
>>> It's set to a static shell (/bin/ksh these days) for a reason.
>>>
>>>
>> Changing the root shell doesn't hurt. But you have to install your shell
>> static. I use the bash-static from packages, and hadn't any problems. I
>> think that booting in single and cleaning some trash, might solve the
>> problem. Also you might want to consider installing the bash-static.
>>
>> My 2 cents,
>
> If you change it, fine. But don't tell others that this is not a
> problem. It can be a very big one if a critical box is 500km
> away in some datacenter and your remote upgrade failed because you
> removed all packages without thinking that you still need to keep
> bash... If you don't believe me that these things happen, search
> the archive.

There's a more basic rule I like:

KEEP IT SIMPLE, KEEP IT LEAN.

The more stuff you slop into your system:
..The more stuff you have to keep up to date.
..The more complicated upgrades become.
..The more likely something will go wrong.
..The more things you have to worry about security holes in.
..The less often you will do updates/upgrades because it is "difficult".
..The more ignorant you will look when confronted with a system without
    the slop.
and so on...

I doubt many people have had a non-responsive system and said to
themselves, "Gee, if only I had installed bash on it".

Learn your base system. If you really NEED something, where you can say
clearly why and what benefit there is to you that outweighs the risks,
well, fine. But slopping your system with crud just to make it look like
something else or just because you can is not a good idea.

Nick.