lowfilesystemverified ✓

Ensure /var is on a separate filesystem

mount-var-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /var directory must be on a separate filesystem or logical volume. A dedicated partition for /var prevents log and spool growth from filling the root filesystem.

Rationale

Without a separate /var filesystem, log files and other variable data could fill the root filesystem, causing system instability or preventing auditing from functioning correctly. A separate partition provides isolation and allows independent capacity management.

Check → Remediate

Checkcommand

findmnt /var 2>/dev/null | grep -v '^TARGET' | awk '{print $1}' | grep -q '/var$'

expected_exit:: 0

Remediatemanual

note:: Create a separate partition or logical volume for /var and add it to /etc/fstab. Migrate existing /var data to the new partition.

Framework references

CIS

rhel9 1.1.2.4.1rhel10 1.1.2.4.1rhel8 1.1.2.4.1

STIG

V-280939 / RHEL-10-000550V-230292

NIST 800-53

CM-6SC-5

Live verification

rhel10:checkrhel8:checkrhel9:check

#mount#var#filesystem#hardening