Debian comes with
a lot of software, for example the Debian 3.0
woody release includes 6 or 7 (depending on architecture) CD-ROMs of software and thousands of packages, and the Debian 3.1
sarge release ships with around 13 CD-ROMs of software. With so much software, and even if the base system installation is quite reduced
you might get carried away and install more than is really needed for your system.
您已经知道了系统的用途(不是吗?), 因此应该只安装真正需要的软件. 安装的任何多余的工具都可能被试图破坏系统的用户或外部入侵者所利用(或通过可利用服务执行远端代码).
例如, 开发工具( C 编译器)或解释型语言(譬如 perl, python, tcl..., 其中 perl 在后面还会讲到) 可以帮助攻击者破坏系统做很多事情:
当然, 一个入侵者通过本地 shell 下载他们的工具并运行, 即使是 shell 本身也能做出复杂的程序. 删除不必要的软件并不能
避免 问题的发生, 但是可以增加入侵者入侵的难度(并且有可能放弃它转而寻找更容易的目标). 因此, 如果在生产系统中安装了用于远程攻击的工具(参阅
第 8.1 节 “远程风险评估工具”), 就不要期望入侵者不会利用它.
Please notice that a default installation of Debian
sarge (i.e. an installation where no individual packages are selected) will install a number of development packages that are not usually needed. This is because some development packages are of
Standard priority. If you are not going to do any development you can safely remove the following packages from your system, which will also help free up some space:
Package Size
------------------------+--------
gdb 2,766,822
gcc-3.3 1,570,284
dpkg-dev 166,800
libc6-dev 2,531,564
cpp-3.3 1,391,346
manpages-dev 1,081,408
flex 257,678
g++ 1,384 (Note: virtual package)
linux-kernel-headers 1,377,022
bin86 82,090
cpp 29,446
gcc 4,896 (Note: virtual package)
g++-3.3 1,778,880
bison 702,830
make 366,138
libstdc++5-3.3-dev 774,982
You must take into account that removing
perl might not be too easy (as a matter of fact it can be quite difficult) in a Debian system since it is used by many system utilities. Also, the
perl-base is
Priority: required (that about says it all). It's still doable, but you will not be able to run any
perl application in the system; you will also have to fool the package management system to think that the
perl-base is installed even if it's not.
哪些程序使用
perl? 运行下边的命令您自己可以看到:
$ for i in /bin/* /sbin/* /usr/bin/* /usr/sbin/*; do [ -f $i ] && {
type=`file $i | grep -il perl`; [ -n "$type" ] && echo $i; }; done
输出的程序是的优先级是 required 或 important:
/usr/bin/chkdupexe of package util-linux.
/usr/bin/replay of package bsdutils.
/usr/sbin/cleanup-info of package dpkg.
/usr/sbin/dpkg-divert of package dpkg.
/usr/sbin/dpkg-statoverride of package dpkg.
/usr/sbin/install-info of package dpkg.
/usr/sbin/update-alternatives of package dpkg.
/usr/sbin/update-rc.d of package sysvinit.
/usr/bin/grog of package groff-base.
/usr/sbin/adduser of package adduser.
/usr/sbin/debconf-show of package debconf.
/usr/sbin/deluser of package adduser.
/usr/sbin/dpkg-preconfigure of package debconf.
/usr/sbin/dpkg-reconfigure of package debconf.
/usr/sbin/exigrep of package exim.
/usr/sbin/eximconfig of package exim.
/usr/sbin/eximstats of package exim.
/usr/sbin/exim-upgrade-to-r3 of package exim.
/usr/sbin/exiqsumm of package exim.
/usr/sbin/keytab-lilo of package lilo.
/usr/sbin/liloconfig of package lilo.
/usr/sbin/lilo_find_mbr of package lilo.
/usr/sbin/syslogd-listfiles of package sysklogd.
/usr/sbin/syslog-facility of package sysklogd.
/usr/sbin/update-inetd of package netbase.
因此, 没有Perl, 除非你在 shell 脚本里重新编制这些程序, 否则您将不能处理任何软件包 (因此您将不能升级系统, 这不是一件好事情).
如果您确定从 Debian 基本系统中删除 Perl, 并且您有比较宽松的时间, 递交错误报告, 以及 shell 脚本程序作为以前的软件包(作为补丁)的替代.
If you wish to check out which Debian packages depend on Perl you can use
$ grep-available -s Package,Priority -F Depends perl
or
$ apt-cache rdepends perl
