Install only the packages the system needs

Description

A minimal installation contains only what the role of the system requires: no graphical environment on a server, no compiler or debugging tools on a production host, no tool installed "just in case". Debian makes it easier by letting the installer skip every task, and by tracking packages installed only as dependencies so that apt-get autoremove can remove them.

Rationale

Each package is attack surface: its vulnerabilities, its services and its setuid binaries. Compilers, debuggers and network tools also help an attacker who got a foothold. Fewer packages also mean fewer updates and a simpler review of the system.

Impact

Removing a package that an application relies on breaks it. Review before removing, and test on a non-production system first.

Audit

1. List the packages installed on purpose with apt-mark showmanual, and check that each one is needed by the role of the system.
2. Run apt-get -s autoremove: it lists dependencies that are no longer needed.
3. Look for packages that rarely belong on a server: graphical environment (dpkg -l 'xserver-xorg*' 'gnome*' 'kde*'), compilers and build tools (gcc, make, build-essential), debuggers (gdb, strace), network tools (nmap, netcat*, tcpdump), unused interpreters.
4. Check that apt-config dump APT::Install-Recommends matches the policy of the organisation.

Remediation

1. Remove each unneeded package with apt-get purge <package>, after checking with apt-get -s purge <package> what else would be removed.
2. Run apt-get autoremove --purge to remove the dependencies left behind.
3. For new systems, start from a minimal installation (no task selected in the installer, or a minimal cloud image) and add packages for the role only.
4. Write down the list of packages expected for each role, so drifts can be spotted.

References

• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-18
• apt-mark(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEB-PKG-011 Do not install recommended and suggested packages automatically

People and lifecycle