CIS Benchmark Fail - Ensure core dumps are restricted

[Septim]

Greetings. I have found that Proxmox does not pass the following CIS Benchmarks:

2536 - Ensure core dumps are restricted

Is it possible to restrict core dumps without negatively impacting PVE?

Thank you in advance!

 

[Stoiko Ivanov]

Please do not open a thread for each of the findings your software has found:
https://forum.proxmox.com/threads/c...e-layout-randomization-aslr-is-enabled.95043/
https://forum.proxmox.com/threads/cis-benchmark-fail-bootloader-configuration.95042/
https://forum.proxmox.com/threads/cis-benchmark-fail-filesystem-integrity-checks.95039/
https://forum.proxmox.com/threads/cis-benchmark-fail-sudo.95038/
https://forum.proxmox.com/threads/c...noexec-option-set-on-dev-shm-partition.95035/
https://forum.proxmox.com/threads/c...-audit-and-home-parition-configuration.95033/
https://forum.proxmox.com/threads/cis-benchmark-fail-filesystems-mounted.95031/

The short answer is - Proxmox VE is based on Debian - so most of the things should work without any issue - I'd suggest you simply try to configure them accordingly.

regarding sudo - proxmox VE does rely on the `root` account not being locked for cluster operations (and certain settings in the GUI are restricted to the root@pam user) - additionally PVE does not use sudo

regarding the boot-loader issue - check the reference documentation on the subject:
https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#sysboot

regarding the separate partitions - this should not be a problem - however the PVE Installer ISO does not partition the disks in that way - you'd have to go the route of installing PVE on top of debian:
https://pve.proxmox.com/wiki/Install_Proxmox_VE_on_Debian_11_Bullseye

I hope this helps!

 

[Septim]

I apologize for the annoyance, and will take the complaint into account.
Thanks a lot for your answers! Cheers.

 

[Stoiko Ivanov]

I apologize for the annoyance, and will take the complaint into account.

No need for an apology ! - I was just confused by the many threads

Glad that my answer helped a bit!