Detections
Analytics

1.2.1.2 Ensure weak dependencies are configured

Information

The Debian packaging specification allows for 3 levels of dependencies to be declared:

hard dependencies ( Requires ) for packages which must be installed for a minimal installation of the application to function
weak dependencies ( Recommends ) for packages which provide additional features, but which are not required for a minimal installation to function
hints ( Suggests ) for packages which offer add-ons which might be useful.

Unless a system specifically requires the additional capabilities provides by the weak dependencies, it is recommended that the packages are not installed to reduce the potential attack surface.

Solution

Create a file under /etc/apt/apt.conf.d/ to disable the installation of weak dependencies:

# printf '%s\n%s\n' "" 'APT::Install-Recommends "0";' 'APT::Install-Suggests "0";' > /etc/apt/apt.conf.d/60-no-weak-dependencies

Note : All configuration files under /etc/apt/apt.conf.d/ are sorted in lexicographic order and where conflicting settings exist the last one will take precedence.

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-6, 800-53|CM-7, 800-53|SI-2, CSCv7|9.2

Plugin: Unix

Control ID: e5f005dcd1317f7aa2a9ab19708d0e8818e021e3fa8d284b034e8222ec8ad936