{
  "id": "CB-UBU-PKG-011",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-011",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-011.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-011.yml",
  "profiles_effective": [
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-PKG-011",
    "title": "Do not install recommended and suggested packages automatically",
    "finding": {
      "title": "APT installs recommended packages automatically",
      "description": "Each installation pulls in packages nobody asked for, which grow the attack surface without being reviewed."
    },
    "status": "active",
    "profiles": [
      "server-hardened",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "apt",
      "packages",
      "minimal-install"
    ],
    "description": "Ubuntu packages declare strong dependencies (`Depends`) and weak ones (`Recommends`,\n`Suggests`). By default APT also installs recommended packages. `APT::Install-Recommends` and\n`APT::Install-Suggests` set to `false` make it install strong dependencies only.\n",
    "rationale": "Recommended packages are often optional services, documentation tools or helpers that the\nsystem does not need. Installing only what is required keeps the system minimal, as asked by\nthe minimal installation principle.\n",
    "impact": "Some features can be missing after an installation (for example a plugin or a helper shipped as\na recommendation). Install them explicitly with `apt-get install <package>`, or once with\n`apt-get install --install-recommends <package>`. Packages already installed are not removed.\n",
    "notes": "Ubuntu Desktop installs most of its applications as recommendations of the `ubuntu-desktop`\nmetapackage. With this setting, applications that a later version of the metapackage\nrecommends (after an update or a release upgrade) are not installed; nothing already installed\nis removed.\n",
    "setting": {
      "location": "/etc/apt/apt.conf.d/",
      "default_value": "Install-Recommends true, Install-Suggests false",
      "recommended_value": "Install-Recommends false, Install-Suggests false"
    },
    "audit": {
      "manual": "Run `apt-config dump APT::Install-Recommends APT::Install-Suggests`. Both must be `0` or\n`false`.\n",
      "checks": [
        {
          "id": "weak-deps",
          "engine": "shell",
          "description": "APT::Install-Recommends and APT::Install-Suggests, as merged by apt-config.",
          "spec": {
            "script": "eval \"$(apt-config shell R APT::Install-Recommends S APT::Install-Suggests)\" || exit 3\necho \"Install-Recommends=${R:-unset} Install-Suggests=${S:-unset}\"\ncase ${R:-true} in 0 | false | no | off) ;; *) exit 1 ;; esac\ncase ${S:-false} in 0 | false | no | off) ;; *) exit 1 ;; esac\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Create `/etc/apt/apt.conf.d/99cirsec-no-recommends` with:\n\n```\nAPT::Install-Recommends \"false\";\nAPT::Install-Suggests \"false\";\n```\n\nand remove any later setting of these options (`/etc/apt/apt.conf` is read after the\ndirectory).\n",
      "effects": {
        "restart": "none",
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Remove `/etc/apt/apt.conf.d/99cirsec-no-recommends`.\n",
      "scripts": [
        {
          "id": "weak-deps",
          "engine": "shell",
          "content": "f=/etc/apt/apt.conf.d/99cirsec-no-recommends\ncb_backup \"$f\"\nprintf '%s\\n' '// CB-UBU-PKG-011: install strong dependencies only.' 'APT::Install-Recommends \"false\";' 'APT::Install-Suggests \"false\";' >\"$f\"\n"
        }
      ]
    },
    "references": [
      {
        "title": "apt.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/apt.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "apt-get(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/apt-get.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R58",
        "relation": "partial",
        "note": "R58 asks for a minimal set of packages; this control stops APT from adding optional ones."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-PKG-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened, kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened, kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fails on stock (Install-Recommends 1); fix writes 99cirsec-no-recommends; passes for server-hardened and desktop-hardened."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}