Configure the Debian security repository

Description

The Debian security team publishes fixes in the <codename>-security suite (for example trixie-security), served from security.debian.org/debian-security and deb.debian.org/debian-security. Each Debian release needs an enabled deb entry for this suite, or for an internal mirror of it.

Rationale

Fixes for vulnerabilities reach the main suite only with point releases, weeks or months later. Without the security suite, a system stays exposed to every published vulnerability in the meantime, even if updates are applied every day.

Impact

None known. The system must reach the security mirror or an internal copy of it.

Setting

Audit

Run apt-cache policy | grep -- '-security'. It must list the <codename>-security suite of the installed release (. /etc/os-release; echo "$VERSION_CODENAME").

Automated: every check must pass. Scanners report each check by its id.

security-suite

Enabled deb entries for the security suite of the installed release.

script: |
  c=$( (. /etc/os-release && printf '%s' "${VERSION_CODENAME:-}") 2>/dev/null)
  [ -n "$c" ] || { echo "VERSION_CODENAME unknown in /etc/os-release"; exit 3; }
  files=
  for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
    [ -f "$f" ] && files="$files $f"
  done
  [ -n "$files" ] || { echo "no APT source file"; exit 1; }
  # One line per entry: file:line, types, URIs, suites, ;option=value list (lowercase).
  # shellcheck disable=SC2086
  awk '
    function flush() { if (st && en != "no") print src "\t" ty "\t" ur "\t" su "\t" op; st = 0; ty = ur = su = op = en = "" }
    FNR == 1 { flush(); d = FILENAME ~ /\.sources$/ }
    !d {
      sub(/#.*/, ""); if ($1 !~ /^deb(-src)?$/) next
      l = $0; o = ""; i = index(l, "["); j = index(l, "]")
      if (i && j > i) { o = substr(l, i + 1, j - i - 1); l = substr(l, 1, i - 1) " " substr(l, j + 1) }
      split(l, w, " "); gsub(/[ \t]+/, ";", o)
      print FILENAME ":" FNR "\t" w[1] "\t" w[2] "\t" w[3] "\t;" tolower(o); next
    }
    /^#/ { next }
    /^[ \t]*$/ { flush(); next }
    /^[ \t]/ { next }
    {
      if (!st) { st = 1; src = FILENAME ":" FNR }
      k = $0; sub(/:.*/, "", k); k = tolower(k); v = $0; sub(/^[^:]*:[ \t]*/, "", v)
      if (k == "types") ty = v; else if (k == "uris") ur = v; else if (k == "suites") su = v
      else if (k == "enabled") en = tolower(v)
      else op = op ";" k "=" tolower(v == "" ? "inline" : v)
    }
    END { flush() }' $files | awk -F '\t' -v s="$c-security" '
    {
      nt = split($2, t, " "); ns = split($4, w, " "); deb = 0
      for (i = 1; i <= nt; i++) if (t[i] == "deb") deb = 1
      for (i = 1; i <= ns; i++) if (deb && w[i] == s) { print $1 " " $3 " " s; found = 1 }
    }
    END { if (!found) print "no enabled deb entry for " s; exit !found }'

Remediation

Add the security suite, for example in /etc/apt/sources.list.d/debian-security.sources (replace trixie with the codename of the installed release, or the URI with an internal mirror):

Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Use the same components as the main entry (contrib, non-free, non-free-firmware), then run apt-get update.

References

• Debian Security FAQ Debian, vendor-doc, accessed 2026-10-18
• Debian Wiki - SourcesList Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R61) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-PKG-007 Install security updates automatically
• related CB-DEB-PKG-008 Leave no security update pending

People and lifecycle