@test "Verify APT Install-Suggests" {
run bash -c "grep '^APT::Install-Suggests \"false\";$' /etc/apt/apt.conf.d/*"
[ "$status" -eq 0 ]
}Ensure APT has Install-Suggests configured
Description
The Install-Suggests setting makes apt-get or apt not consider
suggested packages as a dependency for installing.
Rationale
Reducing the amount of installed packages might reduce any attack surface.
Audit
Remediation
shell
if ! grep '^APT::Install-Suggests' /etc/apt/apt.conf.d/*; then
echo 'APT::Install-Suggests "false";' >> /etc/apt/apt.conf.d/01-vendor-ubuntu
else
sed -i 's/.*APT::Install-Suggests.*/APT::Install-Suggests "false";/g' "$(grep -l 'APT::Install-Suggests' /etc/apt/apt.conf.d/*)"
fiAnsible
---
- name: configure apt
become: 'yes'
become_method: sudo
lineinfile:
dest: /etc/apt/apt.conf.d/98apt-conf
mode: 0644
state: present
create: 'yes'
line: ""
with_items:
- 'APT::Get::Install-Suggests "false";'
when: ansible_os_family == "Debian"
tags:
- apt
- security
...