#nano\u00a0\/etc\/security\/limits.conf<\/p>\n
*<\/span> hard core 0<\/p>\n Set runtime for fs.suid_dumpable<\/span> <\/strong> This section helps mitigate against Buffer Overflow attacks (BOF).<\/p>\n Enable ExecShield<\/strong><\/i><\/p>\n Helps prevent stack smashing \/ BOF.<\/p>\n Enable on current kernel: Add to \/etc\/sysctl.conf:<\/p>\n Set runtime for kernel.randomize_va_space Add Recent processors in the x86 family support the ability to prevent code execution on a per memory page basis. Generically and on AMD processors, this ability is called No Execute (NX)<\/strong>, while on Intel processors it is called Execute Disable (XD)<\/strong>. This ability can help prevent exploitation of buffer overflow vulnerabilities and should be activated whenever possible. Extra steps must be taken to ensure that this protection is enabled, particularly on 32-bit x86 systems. Other processors, such as Itanium and POWER, have included such support since inception and the standard kernel for those platforms supports the feature.<\/p>\n Check bios and ensure XD\/NX is enabled, not relevant for VM\u2019s.<\/p>\n SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via .rhosts files.<\/p>\n To ensure this behavior is disabled, add or correct the following line in <\/p>\n","protected":false},"excerpt":{"rendered":" Disable core dumps for all users #nano\u00a0\/etc\/security\/limits.conf * hard core 0 Disable core dumps for SUID programs #sysctl -w fs.suid_dumpable=0 #fs.suid_dumpable = 0 Set runtime for fs.suid_dumpable #sysctl -q -n -w fs.suid_dumpable=0 If fs.suid_dumpable present in \/etc\/sysctl.conf, change value to “0” else, add “fs.suid_dumpable = 0” to \/etc\/sysctl.conf if grep –silent ^fs.suid_dumpable \/etc\/sysctl.conf ; then … Continue reading Notes<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"Notes - HP Server","description":"Disable core dumps for all users #nano\u00a0\/etc\/security\/limits.conf * hard core 0 Disable core dumps for SUID programs # sysctl -w fs.suid_dumpable=0 # fs.suid_dum"},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1327","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts\/1327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/comments?post=1327"}],"version-history":[{"count":0,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts\/1327\/revisions"}],"wp:attachment":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/media?parent=1327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/categories?post=1327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/tags?post=1327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Disable core dumps for SUID programs<\/h2>\n
#<\/span>sysctl -w fs.suid_dumpable=0<\/code>
\n#fs.suid_dumpable = 0<\/code><\/p>\n
\n#<\/span>sysctl -q -n -w fs.suid_dumpable=<\/span>0
\n
\nIf fs.suid_dumpable present in \/etc\/sysctl.conf, change value to “0”<\/span> else, add “fs.suid_dumpable = 0” to \/etc\/sysctl.conf<\/span>
\n
\nif grep –silent ^fs.suid_dumpable \/etc\/sysctl.conf ; then sed -i ‘s\/^fs.suid_dumpable.*\/fs.suid_dumpable = 0\/g’<\/span> \/etc\/sysctl.conf else echo<\/span> “”<\/span> >> \/etc\/sysctl.conf echo<\/span> “# Set fs.suid_dumpable to 0 per security requirements”<\/span> >> \/etc\/sysctl.conf echo<\/span> “fs.suid_dumpable = 0”<\/span> >> \/etc\/sysctl.conf
\nfi
\n<\/span><\/p>\nBuffer Overflow Protection<\/h2>\n
sysctl -w kernel.exec-shield=1<\/code><\/p>\nkernel.exec-shield =<\/span> 1<\/code><\/pre>\n<\/figure>\nCheck \/ Enable ASLR<\/i><\/h2>\n
sysctl -q -n -w kernel.randomize_va_space=2<\/code><\/p>\nkernel.randomize_va_space = 2<\/code> to \/etc\/sysctl.conf if it does not already exist.<\/p>\nEnable XD or NX Support on x86 Systems<\/i><\/h2>\n
Disable SSH Support for .rhosts Files<\/i><\/h3>\n
\/etc\/ssh\/sshd_config<\/code>:<\/p>\nIgnoreRhosts yes<\/code><\/pre>\n<\/figure>\n