Ensure core dumps are disabled

MoyenneNiveau 1Automatiséeaix

Description

This change disables core dumps in the default user stanza of /etc/security/limits and also ensures the fullcore kernel parameter is set to false. The creation of core dumps can reveal pertinent system information, potentially even passwords, within the core file. The ability to create a core dump is also a vulnerability to be exploited by a hacker. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v lssec >/dev/null 2>&1 || exit 1; command -v lsattr >/dev/null 2>&1 || exit 1; a=$(lssec -f /etc/security/limits -s default -a core -a core_hard 2>/dev/null) || exit 1; b=$(lsattr -El sys0 -a fullcore -F value 2>/dev/null) || exit 1; [ "$a" = "default core=0 core_hard=0" ] && [ "$b" = false ] && echo compliant || echo "$a fullcore=$b"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

chsec -f /etc/security/limits -s default -a core=0 -a core_hard=0; chdev -l sys0 -a fullcore=false

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aixhardening
Référence: CIS IBM AIX 7 Benchmark v1.2.0 - 4.8.3 Ensure core dumps are disabled

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target aix