1

I am trying to create a minimal install of Ubuntu Server 14.04.3. I selected the "minimal" option during installation.

My system now has two meta packages, ubuntu-minimal and ubuntu-standard. The latter contains many packages which go above and beyond what I would consider a "minimal" installation for a server e.g. telnet and ftp clients.

I would like to remove some of these packages however doing so will also remove the metapackage. The description of ubuntu-standard contains the following warning:

It is also used to help ensure proper upgrades, so it is recommended that it not be removed.

I can find little information on what this actually means. The best I've come up with is this answer, which suggests that the removal of a metapackage will cause problems when upgrading to a new version of Ubuntu.

Other than when upgrading to new versions of Ubuntu, are there any other consequences of removing a metapackage? Is it possible that a package could be added to or removed from the metapackage for security reasons, that I would miss out on in the absence of the metapackage? E.g. it is decided that Package X should now be part of ubuntu-standard to fix some newly discovered security issue. Will the update process of any remaining packages on my system be unaffected?

2

Of course you could. A metapackage is just a convenient way of bundling packages. Sure, they may come with stuff you don't immediately or ever need, but if at some point you decide that you need a desktop environment after all, you'll be happy about ubuntu-desktop or the like.

That said, I don't see any good reason why you should do so. Looking at the dependencies of ubuntu-standard, I find the vast majority of packages it installs are quite essential. Especially for administrating a system from the command line. The fact that you don't need an ftp client today, doesn't mean you won't need one in the future.

Furthermore, those aren't large packages. ftp takes about 140kB disk space. If the available space is that constraint, I think Ubuntu is not the right distribution for your needs.

Finally, if in a year or so you decide to upgrade to 16.04 LTS, you'll find yourself reinstalling that metapackage to make the release upgrade work.

Actually, there is one other thing. The packages installed through a metapackage are marked automatically installed. Meaning, if the metapackage is removed, the package system will suggest them for autoremoval unless you mark them as manually installed. Although I believe that is not the case for metapackages installed at system setup, only for those installed later. Take a look yourself and see if e.g ftp is marked auto or not: apt-mark showauto | grep ftp

In principle, if the dependencies of a metapackage change, you will miss out on those changes. You will still receive updates for the currently installed packages though, depending on which repositories are enabled.

If this happens in practice except with new releases I do not know, but I doubt it. The only prominent counterexample I can think of are the kernel metapackages. They will (on the desktop releases anyway) always point to the latest available kernel. Removing the metapackages will prevent new kernels from being installed. That may be wanted, but the better solution would be to hold the metapackage.

In my opinion you likely won't break anything, so I can't advise against it absolutely. But personally I don't think it worthwhile. At least not regarding such small and yet very handy tools.

Addendum: OP makes a compelling point in the comments below. Security must be taken very seriously especially in a server setting. Minimizing attack vectors includes getting rid of unneeded and unwanted software. If you find a piece of software that poses a potential security risk and is not necessary, by all means get rid of it!

On a server running a sensitive service, say Kerberos, I think it's really best practice to strip the system down to the essentials.

That said, since the question is about ubuntu-standard, I didn't see any harm with the packages installed. So I stand by my opinion :-)

  • Thanks for the answer. To address the "why" part - disk space is not a consideration for me. It is more a matter of (a) I dislike things I can't understand. Reviewing and deciding the fate of each and every package on my system helps my learning process, (b) as it is a server, I want it minimise all possible attack vectors. A ftp client is unlikely to be vulnerable, but paranoia never hurts when it comes to security, and see (a) - I would prefer not to spend mental effort ascertaining if a package may or may not present a security risk, when I can simply delete it. – Jon Bentley Sep 29 '15 at 17:07
  • As for administration, upgrading versions, etc. - I intend to manage my servers using my choice of configuration management tool, so its hard to imagine a use for ftp or telnet. If I do need them later, reinstalling them isn't an issue. I still like Ubuntu as I like the comfort of having updates provided by a reputable and stable distribution. – Jon Bentley Sep 29 '15 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.