The CoreDumpDirectory directive is used to specify the directory Apache attempts to switch to before creating the core dump. Core dumps will be disabled if the directory is not writable by the Apache user. Also, core dumps will be disabled if the server is started as root and switches to a non-root user, as is typical. It is recommended that the CoreDumpDirectory directive be set to a directory that is owned by the root user, owned by the group the Apache HTTPD process executes as, and be inaccessible to other users.
Rationale
Core dumps are snapshots of memory and may contain sensitive information that should not be accessible by other accounts on the system.
Audit
Verify that either the CoreDumpDirectory directive is not enabled in any of the Apache configuration files or that the configured directory meets the following requirements:
CoreDumpDirectory is not within the Apache web document root ($APACHE_PREFIX/htdocs)
Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive)
Must have no read-write-search access permission for other users. (e.g. o=rwx)
Remediation
Either remove the CoreDumpDirectory directive from the Apache configuration files or ensure that the configured directory meets the following requirements.
CoreDumpDirectory is not to be within the Apache web document root ($APACHE_PREFIX/htdocs)
Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive)
# chown root:apache /var/log/httpd
Must have no read-write-search access permission for other users.
# chmod o-rwx /var/log/httpd
Default Value
The default core dump directory is the ServerRoot directory.
3.3 Configure Data Access Control ListsConfigure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.
●
●
●
v7
14.6 Protect Information through Access Control ListsProtect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities.
●
●
●
Profile
Level 1 | Manual
1---2name: cis-apache24-3-73description: Ensure the Core Dump Directory Is Secured4---56# 3.7 Ensure the Core Dump Directory Is Secured78## Profile Applicability910- Level 11112## Description1314The `CoreDumpDirectory` directive is used to specify the directory Apache attempts to switch to before creating the core dump. Core dumps will be disabled if the directory is not writable by the Apache user. Also, core dumps will be disabled if the server is started as root and switches to a non-root user, as is typical. It is recommended that the `CoreDumpDirectory` directive be set to a directory that is owned by the root user, owned by the group the Apache HTTPD process executes as, and be inaccessible to other users.1516## Rationale1718Core dumps are snapshots of memory and may contain sensitive information that should not be accessible by other accounts on the system.1920## Audit2122Verify that either the `CoreDumpDirectory` directive is not enabled in any of the Apache configuration files or that the configured directory meets the following requirements:23241. `CoreDumpDirectory` is not within the Apache web document root (`$APACHE_PREFIX/htdocs`)252. Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive)263. Must have no read-write-search access permission for other users. (e.g. `o=rwx`)2728## Remediation2930Either remove the `CoreDumpDirectory` directive from the Apache configuration files or ensure that the configured directory meets the following requirements.31321. `CoreDumpDirectory` is not to be within the Apache web document root (`$APACHE_PREFIX/htdocs`)332. Must be owned by root and have a group ownership of the Apache group (as defined via the Group directive)343. `# chown root:apache /var/log/httpd`354. Must have no read-write-search access permission for other users.365. `# chmod o-rwx /var/log/httpd`3738## Default Value3940The default core dump directory is the `ServerRoot` directory.4142## References43441. https://httpd.apache.org/docs/2.4/mod/mpm_common.html#coredumpdirectory4546## CIS Controls4748| Controls Version | Control | IG 1 | IG 2 | IG 3 |49| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |50| v8 | 3.3 Configure Data Access Control Lists<br>Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | ● | ● | ● |51| v7 | 14.6 Protect Information through Access Control Lists<br>Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | ● | ● | ● |5253## Profile5455- Level 1 | Manual
Run npx skillmds@latest add cyberstrikeus/cis-apache24-3-7 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Ensure the Core Dump Directory Is Secured It is listed under Coding & Dev Tools on SkillMD.
SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.
cyberstrikeus