I have read a recommendation which was stating that after installing one should remove some packages from the default Ubuntu installation, in order to have a more secure server. What are your recommendations for removal?

  • Where is this "recommendation"? The default Ubuntu Server install explicitly asks you what kind of server(s)/services you want to install during the installation process! – ish Jun 4 '12 at 9:28
  • you don't have so much control on exactly what process to install and for example I have a cloud installation where I don't make the installation per se, I choose an OS and I have instantly an instance of it. I've seen this recommendation in several places, I'll find a link for you – Elzo Valugi Jun 4 '12 at 9:43

The most important part is not what packages are installed, but which servers are running, especially those listening on an internet-facing port. Disabling or stopping servers which aren't used is an important first step. Offcourse -removing- such a service does serve as "insurance" that it doesn't get started accidentally somehow, so it might be a good idea.

For removal, the most obvious targets are any programs that come with suid-root executables, and aren't used. A bug in any of these programs will have the potential to allow any random local user to become root, that possibility goes away if you remove the program.

You can use 'find' to find such programs, in a terminal enter: find / -perm -4000 -print this will give you a list of all suid-programs on the system, it will take quite a bit of time with a large disc.

The mere existence of a program on disc which isn't suid-root, and that isn't being run, should not have any large impact on security. You might still want to remove some for other reasons such as freeing up disc-space and reducing clutter though.

| improve this answer | |
  • which are those programs? some examples? – Elzo Valugi Jun 4 '12 at 9:19
  • I edited the answer to include info on how to find such programs. Examples are gpasswd, ksu, Xorg and slock – Agrajag Jun 4 '12 at 9:23
  • 2
    To find public-faced services, use sudo netstat -tunlp. Visit the manpage of netstat to find a description of the options. – Lekensteyn Jun 4 '12 at 9:25
  • I find programs like exim, mysql and smbd. some of that I need. Would you recommend removing samba? – Elzo Valugi Jun 4 '12 at 9:36
  • If you never use it, then removing it, or atleast turning of the suid-root bit has some security-benefit. If it's worth the hassle or not is really one of those "it depends" kind of questions. It takes time, and has the benefit that bugs in smbd will no longer negatively affect your security. Thus in the end it's a trade-off between the value of your time and how important security is to you. – Agrajag Jun 4 '12 at 9:54

Ubuntu has a fairly strong security policy. This includes the requirement that a default install shouldn't run any network servers, listening for outside connections. As those are the cause for most recommendations to uninstall packages, the answer there is no.

However, uninstalling anything you don't actually need will certainly help. It makes the system simpler and easier to understand, and probably reduces the probability of a privilege escalation, should anyone manage to breach the defences.

Personally, I uninstall everything that isn't used by me or the packages I use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.