Check: GEN003510
HP-UX 11.31 STIG:
GEN003510
(in versions v1 r19 through v1 r13)
Title
Kernel core dumps must be disabled unless needed. (Cat II impact)
Discussion
Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in Denial of Service by exhausting the available space on the target file system. The kernel core dump process may increase the amount of time a system is unavailable due to a crash. Kernel core dumps can be useful for kernel debugging.
Check Content
Verify crash dumps are disabled. # crashconf -v If the "included" list is not empty or fully disabled, this is a finding. # crashconf -v | tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | cut -f 3,3 -d " " | \ egrep -c -i "yes," If the above command returns a value >0, this is a finding.
Fix Text
Disable crash dumps. # crashconf -e all Edit /etc/rc.config.d/crashconf and set CRASH_EXCLUDED_PAGES="all".
Additional Identifiers
Rule ID: SV-26607r1_rule
Vulnerability ID: V-22404
Group Title: GEN003510
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |