Ensure core dumps are disabled

SrednjaNivo 1Automatskaaix

Opis

This change disables core dumps in the default user stanza of /etc/security/limits and also ensures the fullcore kernel parameter is set to false. The creation of core dumps can reveal pertinent system information, potentially even passwords, within the core file. The ability to create a core dump is also a vulnerability to be exploited by a hacker. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v lssec >/dev/null 2>&1 || exit 1; command -v lsattr >/dev/null 2>&1 || exit 1; a=$(lssec -f /etc/security/limits -s default -a core -a core_hard 2>/dev/null) || exit 1; b=$(lsattr -El sys0 -a fullcore -F value 2>/dev/null) || exit 1; [ "$a" = "default core=0 core_hard=0" ] && [ "$b" = false ] && echo compliant || echo "$a fullcore=$b"

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

chsec -f /etc/security/limits -s default -a core=0 -a core_hard=0; chdev -l sys0 -a fullcore=false

Svojstva

Operativni sistemi: Bilo koji
Oznake: aixhardening
Referenca: CIS IBM AIX 7 Benchmark v1.2.0 - 4.8.3 Ensure core dumps are disabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target aix