1

I'm working on a BeagleBone Black shipped with Debian. Started reading the Securing Debian page, and part way through I see in a chapter 3 section 3.6.1 Removing Perl. Doing a quick google search gives three 2016 security advisories in the first five results:

  • DSA-3628-1
  • DSA-3501-1
  • DSA-3441-1

The document even states that attempting to remove Perl is non-trivial. So is there a strong recommendation to remove Perl for hardening the system?

  • 2
    Are we supposed to provide an opinion on the opinion in the article? – Jeff Schaller Feb 25 '17 at 13:45
  • Please proceed and close this question as it seems there is consensus it's a bad question. – 杜興怡 Feb 26 '17 at 3:54
4

Removing perl may harm your system, because there a ton of programs witch depend on it, to keep your system secure its better to include the following line:

deb http://security.debian.org/ jessie/updates main contrib non-free

on your sources.list to upgrade/patch the vulnerable packages through apt as soon as possible.

There are some information about the 3 vulnerabilities:

DSA-3628-1

For the stable distribution (jessie), these problems have been fixed in version 5.20.2-3+deb8u6.

DSA-3501-1

For the oldstable distribution (wheezy), this problem has been fixed in version 5.14.2-21+deb7u3.

For the stable distribution (jessie), this problem has been fixed in version 5.20.2-3+deb8u4.

For the unstable distribution (sid), this problem will be fixed in version 5.22.1-8

DSA-3441-1

The oldstable distribution (wheezy) is not affected by this problem.

For the stable distribution (jessie), this problem has been fixed in version 5.20.2-3+deb8u2.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your perl packages.

Edit

You can list the package that depend on perl through apt-cache rdepends perl command. The chapter 3 section 3.6.1 Removing Perl deals with the consequence of removing perl :

So, without Perl and, unless you remake these utilities in shell script, you will probably not be able to manage any packages (so you will not be able to upgrade the system, which is not a Good Thing)

  • 1
    If you're absolutely sure that none of the software that should be on the system requires Perl, then you can safely remove it. However, given that you felt the need to ask this, you are almost certainly not sure enough. – Shadur Feb 25 '17 at 19:07
0

It is recommend to remove everything which is not needed to run your system in order to decrease the potential attack surface. And for the rest of the software make sure everything is well supported and updated because not only Perl can have bugs but also the standard shell bash. Even better would be to start with a minimal system and only add what you explicitly need.

  • thanks, starting minimal is most likely what I will do time permitting. – 杜興怡 Feb 26 '17 at 3:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.