Description
kdump-tools loads a capture kernel at boot (kdump-tools.service). When the main kernel
crashes, the capture kernel saves its memory to /var/crash.
The control passes when kdump-tools.service is masked or not installed at all.
kdump-tools is not installed by default. Systems where kernel developers or support need
dumps should exclude this control in their tailoring file and protect /var/crash instead.
Rationale
The dump holds everything that was in memory: secrets of running services, session keys,
documents. It stays on disk after the reboot and can be copied by anyone who gets access to
/var/crash or to backups. Kernel crash analysis is rarely needed in production.
Impact
Kernel crashes leave no dump to analyse. The memory reserved by the crashkernel= boot
parameter stays reserved until the parameter is removed (apt purge kdump-tools, then
update-grub and a reboot).
Audit
Run systemctl is-enabled kdump-tools.service. It must print masked, or fail because the unit
does not exist.
Automated: every check must pass. Scanners report each check by its id.
kdump-tools
kdump capture kernel loader.
unit: kdump-tools.service
state: masked
Remediation
Run systemctl mask --now kdump-tools.service. To also free the reserved memory, run
apt purge kdump-tools, then update-grub, and reboot.
| Restart | none |
| Disruption | none |
Rollback
Run systemctl unmask kdump-tools.service then systemctl enable --now kdump-tools.service.
kdump-tools
Generated from check kdump-tools: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- kdump-tools(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- kdump-config(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service; this control covers kdump. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with kdump-tools installed the check fails, fix masks the service, audit passes after reboot; kdump-tools still purges cleanly. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with kdump-tools installed the check fails, fix masks the service, audit passes after reboot; kdump-tools still purges cleanly. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
