# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-PKG-011
title: Do not install recommended and suggested packages automatically
finding:
  title: APT installs recommended packages automatically
  description: Each installation pulls in packages nobody asked for, which grow the attack surface without being reviewed.
status: active
profiles: [server-hardened, desktop-hardened]
risk:
  severity: low
assessment: automated
tags: [apt, packages, minimal-install]

description: |
  Debian packages declare strong dependencies (`Depends`) and weak ones (`Recommends`,
  `Suggests`). By default APT also installs recommended packages. `APT::Install-Recommends` and
  `APT::Install-Suggests` set to `false` make it install strong dependencies only.
rationale: |
  Recommended packages are often optional services, documentation tools or helpers that the
  system does not need. Installing only what is required keeps the system minimal, as asked by
  the minimal installation principle.
impact: |
  Some features can be missing after an installation (for example a plugin or a helper shipped as
  a recommendation). Install them explicitly with `apt-get install <package>`, or once with
  `apt-get install --install-recommends <package>`. Packages already installed are not removed.

setting:
  location: /etc/apt/apt.conf.d/
  default_value: "Install-Recommends true, Install-Suggests false"
  recommended_value: "Install-Recommends false, Install-Suggests false"

audit:
  manual: |
    Run `apt-config dump APT::Install-Recommends APT::Install-Suggests`. Both must be `0` or
    `false`.
  checks:
    - id: weak-deps
      engine: shell
      description: APT::Install-Recommends and APT::Install-Suggests, as merged by apt-config.
      spec:
        script: |
          eval "$(apt-config shell R APT::Install-Recommends S APT::Install-Suggests)" || exit 3
          echo "Install-Recommends=${R:-unset} Install-Suggests=${S:-unset}"
          case ${R:-true} in 0 | false | no | off) ;; *) exit 1 ;; esac
          case ${S:-false} in 0 | false | no | off) ;; *) exit 1 ;; esac

remediation:
  manual: |
    Create `/etc/apt/apt.conf.d/99cirsec-no-recommends` with:

    ```
    APT::Install-Recommends "false";
    APT::Install-Suggests "false";
    ```

    and remove any later setting of these options (`/etc/apt/apt.conf` is read after the
    directory).
  effects:
    restart: none
    disruption: none
    lockout_risk: false
  rollback: |
    Remove `/etc/apt/apt.conf.d/99cirsec-no-recommends`.
  scripts:
    - id: weak-deps
      engine: shell
      content: |
        f=/etc/apt/apt.conf.d/99cirsec-no-recommends
        cb_backup "$f"
        printf '%s\n' '// CB-DEB-PKG-011: install strong dependencies only.' 'APT::Install-Recommends "false";' 'APT::Install-Suggests "false";' >"$f"

references:
  - title: apt.conf(5), Debian manual pages
    url: https://manpages.debian.org/trixie/apt/apt.conf.5.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: apt-get(8), Debian manual pages
    url: https://manpages.debian.org/trixie/apt/apt-get.8.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R58
    relation: partial
    note: R58 asks for a minimal set of packages; this control stops APT from adding optional ones.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "1.2.1.2"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "1.2.1.2"
    relation: equivalent
related_controls:
  - id: CB-DEB-PKG-010
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened, kept after reboot."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened, kept after reboot."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18