In Ubuntu Linux, whenever a critical application (like a database server or a web daemon) encounters a fatal segmentation fault and crashes, the operating system’s kernel automatically generates a “core dump.” A core dump is a massive, exact copy of the application’s working memory at the precise moment it died. These files are typically handled by systemd-coredump and stored in /var/lib/systemd/coredump/.
While core dumps are invaluable for C/C++ developers debugging complex memory leaks, they are a catastrophic security and stability risk in production environments. Because a core dump is an exact snapshot of RAM, it frequently contains highly sensitive data in plaintext, including database passwords, TLS certificates, and active user session tokens. Furthermore, if a failing application enters a crash loop (dying and restarting repeatedly), the kernel will generate a new core dump every few seconds. These files are often gigabytes in size, and a crash loop will completely fill your root partition within hours, bringing the entire server offline. To protect your sensitive data and prevent storage exhaustion, you must completely disable core dump generation.
Disabling Core Dumps via Systemd
Modern Ubuntu distributions rely on systemd-coredump to process the memory snapshots. You must configure this daemon to discard the data instead of saving it.
- Open a Terminal session (or connect to your server via SSH).
- Open the coredump configuration file in a text editor with root privileges:
sudo nano /etc/systemd/coredump.conf - Look for the line that says:
#Storage=external(it will likely be commented out with a hash symbol). - You must uncomment this line and change the value to “none.” The line must look exactly like this:
Storage=none - Save the file (Ctrl + O, then Enter) and exit the text editor (Ctrl + X).
- Reload the systemd daemon to apply the new configuration:
sudo systemctl daemon-reload
Enforcing Limits via Security Limits
To guarantee that the Linux kernel itself refuses to generate the raw dump (providing a second layer of defense), you must restrict the core file size limit to zero.
- Open the security limits configuration file:
sudo nano /etc/security/limits.conf - Scroll to the absolute bottom of the file and paste the following line:
* hard core 0 - Save the file and exit the text editor.
- Finally, apply the same restriction via sysctl to ensure absolute compliance:
sudo sysctl -w kernel.core_pattern=|/bin/false
Your Ubuntu server will now fail silently. When a production application encounters a fatal error, it will die immediately without dumping its sensitive memory to the hard drive, protecting your secrets and preserving your disk space.