Ensure core dumps are disabled

SedangLevel 1Otomatisaix

Deskripsi

This change disables core dumps in the default user stanza of /etc/security/limits and also ensures the fullcore kernel parameter is set to false. The creation of core dumps can reveal pertinent system information, potentially even passwords, within the core file. The ability to create a core dump is also a vulnerability to be exploited by a hacker. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Cara pemeriksaan

Metode audit: Perintah shell

shell

command -v lssec >/dev/null 2>&1 || exit 1; command -v lsattr >/dev/null 2>&1 || exit 1; a=$(lssec -f /etc/security/limits -s default -a core -a core_hard 2>/dev/null) || exit 1; b=$(lsattr -El sys0 -a fullcore -F value 2>/dev/null) || exit 1; [ "$a" = "default core=0 core_hard=0" ] && [ "$b" = false ] && echo compliant || echo "$a fullcore=$b"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

chsec -f /etc/security/limits -s default -a core=0 -a core_hard=0; chdev -l sys0 -a fullcore=false

Properti

Sistem operasi: Apa saja
Tag: aixhardening
Referensi: CIS IBM AIX 7 Benchmark v1.2.0 - 4.8.3 Ensure core dumps are disabled

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target aix