@test "Verify APT Install-Recommends" {
run bash -c "grep '^APT::Install-Recommends \"false\";$' /etc/apt/apt.conf.d/*"
[ "$status" -eq 0 ]
}Ensure APT has Install-Recommends configured
Description
The Install-Recommends setting makes apt-get or apt not consider
recommended packages as a dependency for installing.
Rationale
Reducing the amount of installed packages might reduce any attack surface.
Audit
Remediation
shell
if ! grep '^APT::Install-Recommends' /etc/apt/apt.conf.d/*; then
echo 'APT::Install-Recommends "false";' >> /etc/apt/apt.conf.d/01-vendor-ubuntu
else
sed -i 's/.*APT::Install-Recommends.*/APT::Install-Recommends "false";/g' "$(grep -l 'APT::Install-Recommends' /etc/apt/apt.conf.d/*)"
fiAnsible
---
- name: configure apt
become: 'yes'
become_method: sudo
lineinfile:
dest: /etc/apt/apt.conf.d/98apt-conf
mode: 0644
state: present
create: 'yes'
line: ""
with_items:
- 'APT::Get::Install-Recommends "false";'
when: ansible_os_family == "Debian"
tags:
- apt
- security
...