Put /home, /var, /var/tmp, /var/log and /var/log/audit on separate filesystems

Description

Each directory of {{ separate_mounts }} is the mount point of its own filesystem (partition, LVM logical volume, or bind mount of a dedicated volume), instead of a plain directory of the root filesystem.

Debian cloud images have a single root partition, so this control fails there by design. The Debian installer creates these partitions with the "separate /home, /var and /tmp" recipe, or with a custom LVM layout.

Rationale

Separate filesystems contain disk exhaustion: logs or user files that grow without bound stop at their own volume, and the system keeps running and logging. They are also the only way to give these trees restrictive mount options (nodev, nosuid, noexec, see CB-DEB-FS-006), and they keep audit logs available when other data fills up.

Impact

Partitioning is chosen at installation. Changing it later means adding disks or shrinking volumes, moving data and editing /etc/fstab, with downtime. Volumes that are too small fill up sooner: size them from the expected log and data volumes, and prefer LVM to resize later.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

For each directory of {{ separate_mounts }}, run findmnt -kn <directory>. It must print a line.

Automated: every check must pass. Scanners report each check by its id.

mounts

Each listed directory is a mount point.

script: |
  rc=0
  for p in $CB_SEPARATE_MOUNTS; do
    o=$(findmnt -kn -o SOURCE,FSTYPE --mountpoint "$p" | tail -n 1)
    if [ -n "$o" ]; then echo "$p: $o"; else echo "$p: not a separate filesystem"; rc=1; fi
  done
  exit $rc

Remediation

At installation, create a partition or LVM logical volume for each directory of {{ separate_mounts }}.

On an installed system, for each missing one:

1. Create the volume and its filesystem (for example lvcreate then mkfs.ext4).
2. In single-user mode or with the services that write there stopped, mount it on a temporary directory and copy the data with cp -a (or rsync -aHAX), keeping owners and modes.
3. Add the line to /etc/fstab with the options of CB-DEB-FS-006, mount it on the target directory, check, and remove the old copy hidden under the mount point.
4. Reboot and check that every service starts.

References

• Debian GNU/Linux Installation Guide - Partitioning for Debian Debian, vendor-doc, accessed 2026-10-18
• file-hierarchy(7), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R28, R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-FS-006 Mount separate filesystems with nodev, nosuid and noexec where they are not needed
• related CB-DEB-FS-003 Mount /tmp as a separate filesystem with nodev, nosuid and noexec

People and lifecycle