diff --git a/docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd b/docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd index 46163a4..c306258 100644 --- a/docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd +++ b/docs/harbian_audit_Debian_9_Benchmark_v0.1.mkd @@ -1652,6 +1652,26 @@ Remove any found ".shosts" and "shosts.equiv" files from the system. # rm /[path]/[to]/[file]/shosts.equiv ``` +## 10.1.13 Disabled Kernel core dumps (Scored) + +### Profile Applicability +Level 2 + +### Description +Kernel core dumps must be disabled unless needed. + +### Rationale +Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition. + +### Aduit +Verify that kernel core dumps are disabled unless needed. Check the status of the "kdump" service with the following command: +``` +# grep "core" /etc/security/limits.conf +``` +If the kernel core dump is set, this is a finding. + +### Remediation +If kernel core dumps are not required, delete the contain "core" line in /etc/security/limits.conf.