Ensure core dumps are disabled

MediaNivel 1Automatizadaaix

Descripción

This change disables core dumps in the default user stanza of /etc/security/limits and also ensures the fullcore kernel parameter is set to false. The creation of core dumps can reveal pertinent system information, potentially even passwords, within the core file. The ability to create a core dump is also a vulnerability to be exploited by a hacker. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v lssec >/dev/null 2>&1 || exit 1; command -v lsattr >/dev/null 2>&1 || exit 1; a=$(lssec -f /etc/security/limits -s default -a core -a core_hard 2>/dev/null) || exit 1; b=$(lsattr -El sys0 -a fullcore -F value 2>/dev/null) || exit 1; [ "$a" = "default core=0 core_hard=0" ] && [ "$b" = false ] && echo compliant || echo "$a fullcore=$b"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

chsec -f /etc/security/limits -s default -a core=0 -a core_hard=0; chdev -l sys0 -a fullcore=false

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aixhardening
Referencia: CIS IBM AIX 7 Benchmark v1.2.0 - 4.8.3 Ensure core dumps are disabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target aix