Disable KDump Kernel Crash Analyzer (kdump)
Ensures the kernel crash-dump service (kdump.service) is disabled and not running unless the host is used for kernel debugging.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Kernel core dumps may contain the full contents of system memory at the time of the crash, including secrets, keys and credentials, and they consume large amounts of disk space, risking denial of service by filling the target partition. Unless the system is used for kernel development or testing, kdump should be disabled.
What Pavois checks
Pavois queries the resolved unit state with systemctl is-enabled / is-active for kdump.service. The effective state catches a unit enabled via a drop-in or by the kernel crashkernel= boot argument that scanning /etc/sysconfig/kdump alone would not reveal.
describe service('kdump.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled kdump.service (expected disabled or not-found) and systemctl is-active kdump.service (expected inactive).
Inspect & investigate
Check systemctl show kdump.service (fields UnitFileState, ActiveState) and journalctl -u kdump.service; crash-dump captures land in /var/crash/.
Remediation
Pavois's harden plan applies a service resource for kdump with actions disable and stop, so the crash-dump service stays off across reboots and is stopped immediately. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | kdump.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling kdump.service means no kernel crash dumps will be captured, which can hinder post-mortem debugging of kernel panics. Precaution: if your operations or support contract requires crash dumps for diagnosing kernel issues, keep kdump enabled and instead secure the dump storage (restricted permissions, dedicated partition). You may also free the memory reserved by crashkernel= once kdump is off.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-213015, UBTU-24-600070 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.