This is an old revision of the document!

Ubuntu - Ram Disk - Mount Logs and Temporary Directories in RAM

To enhance user privacy and reduce the risk of activity tracking on Linux systems, mount temporary directories such as /tmp, /var/tmp, and /var/log in RAM using tmpfs.

This ensures these directories are cleared at every reboot, leaving no logs or temp files behind.
The tmpfs filesystem is a RAM-based filesystem that stores all data in volatile memory rather than on a persistent storage device, making it ideal for privacy-focused configurations.

To keep the system functional, the needed log directory structure is automatically created at startup, ensuring that applications expecting these directories will not fail and critical system services can still operate normally.

The directories we’ll focus on include:

/tmp – Used by applications for temporary files that often contain sensitive information.
/var/tmp – Similar to /tmp but usually preserved between reboots (this behavior will be changed).
/var/log – Contains system and application logs that can reveal user activity patterns and behavior.

WARNING: All activity logs will exist only in RAM and be completely erased when your system powers down or reboots, leaving no trace for forensic analysis.

There will be no ability to access logs from previous sessions.

Edit fstab

Edit fstab to use tmpfs.

Add tmpfs mount entries for /tmp, /var/tmp, and /var/log.

Append the following lines to mount these directories in RAM:

/etc/fstab

tmpfs /tmp       tmpfs defaults,noatime,mode=1777,size=512M 0 0
tmpfs /var/tmp   tmpfs defaults,noatime,mode=1777,size=512M 0 0
tmpfs /var/log   tmpfs defaults,noatime,mode=0755,size=50M  0 0

NOTE: These entries mount the target directories into RAM on each boot with limited memory usage.

defaults – Uses the default mount options for tmpfs.
noatime – Disables updating access time on files, reducing unnecessary writes to RAM.
mode=1777 – Sets permissions to allow all users to write to the directory but prevents them from deleting files owned by others (sticky bit).
mode=0755 – For /var/log, sets more restrictive permissions appropriate for log files.
size=512M or size=50M – Limits the maximum amount of RAM each directory can use to prevent memory exhaustion.
0 0 – Disables filesystem checking and backup operations as they’re unnecessary for tmpfs.

Create a systemd service to recreate log structure

Ensure that essential /var/log sub-directories exist after reboot.

Create the file /etc/systemd/system/log-tmpfs-init.service, with the following content:

/etc/systemd/system/log-tmpfs-init.service

[Unit]
Description=Initialize /var/log directory structure
DefaultDependencies=no
After=local-fs.target
Before=multi-user.target
 
[Service]
Type=oneshot
ExecStart=/usr/local/bin/init-log-tmpfs.sh
RemainAfterExit=true
 
[Install]
WantedBy=multi-user.target

NOTE: This systemd unit runs a script on boot to recreate the log directory layout.

It executes early in the boot process after filesystems are mounted but before most services start, runs once to initialize directories, and remains marked as active afterward.
The service is configured to start automatically during normal system boot.

Create the log structure script

This script will rebuild critical directories

Create the file /usr/local/bin/init-log-tmpfs.sh, with the following content:

/usr/local/bin/init-log-tmpfs.sh

#!/bin/bash
 
# Create essential log directories used by various system services.
mkdir -p /var/log/journal /var/log/cups /var/log/lightdm /var/log/apt /var/log/installer /var/log/nginx /var/log/mysql
 
# Create essential log files that some applications explicitly check for.
touch /var/log/wtmp /var/log/btmp /var/log/lastlog
 
# Set correct ownership and permissions on authentication log files.
chown root:utmp /var/log/wtmp /var/log/btmp
chmod 664 /var/log/wtmp /var/log/btmp
chmod 644 /var/log/lastlog
 
# Restart the journal service to ensure it writes to the newly created directories.
systemctl restart systemd-journald

NOTE: This script creates the necessary directory structure and files for system functionality.

It sets up log directories for critical services (systemd, printing, display, package management, etc.).
It creates essential authentication log files (wtmp, btmp, lastlog).
It applies proper security permissions.
It restarts the journaling service to ensure it recognizes the new structure.

Make the log structure script executable

sudo chmod +x /usr/local/bin/init-log-tmpfs.sh

Enable the log-tmpfs-init service and reload systemd

Apply the changes to systemd:

sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable log-tmpfs-init.service

NOTE: These commands refresh the systemd configuration, apply the new service definition, and enable the new log-tmpfs-init service to start automatically at boot time.

daemon-reexec - ensures systemd itself is restarted with the new configuration.
daemon-reload - makes systemd aware of our new service file.
enable log-tmpfs-init.service - sets up the service to run on each system startup.

Reboot

sudo reboot

NOTE: A system reboot is necessary to fully apply the tmpfs mounts defined in fstab.

After rebooting, the temporary directories will be mounted in RAM, and the log structure will be automatically recreated by our systemd service.
This ensures a clean system state with privacy protection active.

Test the new configuration

Verify that everything is working correctly.

mount | grep tmpfs
ls -la /var/log
df -h | grep tmpfs

NOTE: After rebooting, these commands will help to verify that this configuration is working properly.

The first command confirms that the directories are indeed mounted as tmpfs filesystems.
The second command shows that the log directory structure has been properly recreated by the new log-tmpfs-init service.
The third command displays the size and usage of the tmpfs mounts, which allows the monitoring of memory usage and ensures the allocated sizes are appropriate for the system.

Wiki

Table of Contents