Do not install recommended and suggested packages automatically

Description

Debian packages declare strong dependencies (Depends) and weak ones (Recommends, Suggests). By default APT also installs recommended packages. APT::Install-Recommends and APT::Install-Suggests set to false make it install strong dependencies only.

Rationale

Recommended packages are often optional services, documentation tools or helpers that the system does not need. Installing only what is required keeps the system minimal, as asked by the minimal installation principle.

Impact

Some features can be missing after an installation (for example a plugin or a helper shipped as a recommendation). Install them explicitly with apt-get install <package>, or once with apt-get install --install-recommends <package>. Packages already installed are not removed.

Setting

Audit

Run apt-config dump APT::Install-Recommends APT::Install-Suggests. Both must be 0 or false.

Automated: every check must pass. Scanners report each check by its id.

weak-deps

APT::Install-Recommends and APT::Install-Suggests, as merged by apt-config.

script: |
  eval "$(apt-config shell R APT::Install-Recommends S APT::Install-Suggests)" || exit 3
  echo "Install-Recommends=${R:-unset} Install-Suggests=${S:-unset}"
  case ${R:-true} in 0 | false | no | off) ;; *) exit 1 ;; esac
  case ${S:-false} in 0 | false | no | off) ;; *) exit 1 ;; esac

Remediation

Create /etc/apt/apt.conf.d/99cirsec-no-recommends with:

APT::Install-Recommends "false";
APT::Install-Suggests "false";

and remove any later setting of these options (/etc/apt/apt.conf is read after the directory).

Rollback

Remove /etc/apt/apt.conf.d/99cirsec-no-recommends.

weak-deps

f=/etc/apt/apt.conf.d/99cirsec-no-recommends
cb_backup "$f"
printf '%s\n' '// CB-DEB-PKG-011: install strong dependencies only.' 'APT::Install-Recommends "false";' 'APT::Install-Suggests "false";' >"$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apt.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• apt-get(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEB-PKG-010 Install only the packages the system needs

People and lifecycle