Ensure core dumps are disabled

OrtaDüzey 1Otomatikaix

Açıklama

This change disables core dumps in the default user stanza of /etc/security/limits and also ensures the fullcore kernel parameter is set to false. The creation of core dumps can reveal pertinent system information, potentially even passwords, within the core file. The ability to create a core dump is also a vulnerability to be exploited by a hacker. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

command -v lssec >/dev/null 2>&1 || exit 1; command -v lsattr >/dev/null 2>&1 || exit 1; a=$(lssec -f /etc/security/limits -s default -a core -a core_hard 2>/dev/null) || exit 1; b=$(lsattr -El sys0 -a fullcore -F value 2>/dev/null) || exit 1; [ "$a" = "default core=0 core_hard=0" ] && [ "$b" = false ] && echo compliant || echo "$a fullcore=$b"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

chsec -f /etc/security/limits -s default -a core=0 -a core_hard=0; chdev -l sys0 -a fullcore=false

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: aixhardening
Referans: CIS IBM AIX 7 Benchmark v1.2.0 - 4.8.3 Ensure core dumps are disabled

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target aix