Description
xserver-common holds the files shared by every X.Org server (Xorg, Xvfb, Xephyr...). When it
is absent, no X server is installed.
The control is only in the hardened server profile; desktops need an X server or Xwayland.
Rationale
An X server is complex software, historically run with root privileges, with a long record of local privilege escalation flaws. A server administered over SSH does not need it.
Impact
Removes xserver-common and every package that depends on it: X servers, and the graphical
desktop if one is installed. X client applications forwarded over SSH (ssh -X) still work,
since they use the X server of the administrator's workstation.
Audit
Run dpkg-query -W -f='${Status}\n' xserver-common. It must not print install ok installed.
Automated: every check must pass. Scanners report each check by its id.
xserver-common
X.Org server common files.
name: xserver-common
state: absent
Remediation
Run apt purge xserver-common after checking the list of packages apt will remove.
| Restart | none |
| Disruption | low |
Rollback
Reinstall the needed X server, for example apt install xserver-xorg-core.
xserver-common
Generated from check xserver-common: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Xserver(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R58 | partial | R58 asks to install only the packages that are strictly needed; this control covers the X server. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1068 |
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with xserver-common installed the check fails, fix purges it, audit passes after reboot; SSH reachable. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with xserver-common installed the check fails, fix purges it, audit passes after reboot; SSH reachable. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
