Install only the packages the system needs

Description

A minimal installation contains only what the role of the system requires: no graphical environment on a server, no compiler or debugging tools on a production host, no tool installed "just in case". Ubuntu makes it easier with the minimized server installation and minimal cloud images, and by tracking packages installed only as dependencies so that apt-get autoremove can remove them. Snaps are packages too: they count as much as the .deb packages.

Rationale

Each package is attack surface: its vulnerabilities, its services and its setuid binaries. Compilers, debuggers and network tools also help an attacker who got a foothold. Fewer packages also mean fewer updates and a simpler review of the system.

Impact

Removing a package that an application relies on breaks it. Review before removing, and test on a non-production system first.

Audit

1. List the packages installed on purpose with apt-mark showmanual, and check that each one is needed by the role of the system.
2. Run apt-get -s autoremove: it lists dependencies that are no longer needed.
3. Look for packages that rarely belong on a server: graphical environment (dpkg -l 'xserver-xorg*' 'gnome*' 'kde*'), compilers and build tools (gcc, make, build-essential), debuggers (gdb, strace), network tools (nmap, netcat*, tcpdump), unused interpreters.
4. Run snap list and check that each snap is needed (on a server, often none but lxd if containers are used).
5. Check that apt-config dump APT::Install-Recommends matches the policy of the organisation.

Remediation

1. Remove each unneeded package with apt-get purge <package>, after checking with apt-get -s purge <package> what else would be removed.
2. Run apt-get autoremove --purge to remove the dependencies left behind, and snap remove --purge <snap> for each unneeded snap.
3. For new systems, start from a minimal installation (the "Ubuntu Server (minimized)" choice of the installer, or a minimal cloud image) and add packages for the role only.
4. Write down the list of packages expected for each role, so drifts can be spotted.

References

• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-19
• apt-mark(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-UBU-PKG-011 Do not install recommended and suggested packages automatically

People and lifecycle