TMA-APACHE-3.7
Ensure the Core Dump Directory Is Secured
설명
The CoreDumpDirectory directive is used to specify the directory Apache attempts to switch to before creating the core dump. Core dumps will be disabled if the directory is not writable by the Apache user. Also, core dumps will be disabled if the server is started as root and switches to a non-root user, as is typical. Manual review: the benchmark gives no reliable automated check for this control.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Verify that either the CoreDumpDirectory directive is not enabled in any of the Apache configuration files or that the configured directory meets the following requirements: 1. CoreDumpDirectory is not within the Apache web document root ($APACHE_PREFIX/htdocs) 2. Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive) 3. Must have no read-write-search access permission for other users. (e.g. o=rwx)
조치 방법
조치 방식: 가이드 또는 인프라 패치
Either remove the CoreDumpDirectory directive from the Apache configuration files or ensure that the configured directory meets the following requirements. 1. CoreDumpDirectory is not to be within the Apache web document root ($APACHE_PREFIX/htdocs) 2. Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive) # chown root:apache /var/log/httpd 3. Must have no read-write-search access permission for other users. # chmod o-rwx /var/log/httpd
속성
- 운영 체제
- 모두
- 태그
- apacheaccounts
- 참고 자료
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 3.7 Ensure the Core Dump Directory Is Secured