[No audio]
One of the most important method of securing your
operating system is to remove unnecessary or orphan packages.
So unnecessary packages are the packages that you do
not need or your system or your application does not
require to have it on your system. And orphan packages
are those that are left behind after you move the
packages and there are dependency on them.
So the first rule is to keep your server lean and mean.
So basically no fat on it.
Install only those packages that you really needed.
If there are unwanted packages, what do you need
to do is simply slash them, delete them.
Fewer the packages, the less chances of unpatched code.
Meaning every time there are issues to any packages that
are installed in your system, there has to be a
code upgrade to upgrade or update that package.
So of course, if you have less of the
packages, the less of the code to fix.
So here are a couple of
guidelines that you should follow.
Number one is do not install packages that you
do not need during the initial installation period.
The initial period or initial installation is when
you are actually going through the installation process.
Make sure you do not pick
any packages that are not needed.
Pick the basic which is base install.
Even without GUI, I would recommend
in corporate environment, don't even pick
the GUI, simply install the Linux,
that gives you a simple command line.
Then if you have to install any packages later on,
pay very close attention to the add on packages.
There are packages that will be added
on as a dependency that are required
for a package to be successfully installed.
So you could install those packages, that is fine,
but there might be some add on additional that
are not needed, but the program gives you like
a promotion kind of thing to install to it.
Please make sure you pay close attention
to it and do not install.
To get a list of all the packages
that your system has right now, the command
that you should run is rpm -qa.
Of course, this is a command that works on
Redhat, CentOS, and Fedora type of Linux distributions.
You could get the listing of all the packages that
you have in your Linux machine through that command.
And the same command, I mean the same purpose
can be served from a different command on a
Ubuntu server, which is apt list -installed.
By the way, both of these commands gives you the same
results to get you the list of all the packages.
What you should do is if you are going
through the package validations or auditing and securing your
system, then what you should do is you should
run these commands, output to a file.
When you get a listing of all the packages you have
installed, put that output to a file and then you should
go through each and every package one by one.
Now I do understand and I completely agree
for those who are thinking right now that
oh my god, I have 1300, 1400 packages. Are you kidding me?
I have to go through it all those packages, one by one?
Okay, the answer, and the hard answer is yes.
If you wanted to secure your system, you have
to go through all of them one by one.
Now, the good news is that when you go through all
of them one by one, and you have a standard build
that your systems, that you're going to be building more systems
down the road, and these are the packages that you need
to install, and the remaining ones you could get rid of,
then it means all that effort will pay off.
You don't have to go
through that filtering process again.
You could just compare what you have, what
you don't need, and then what you don't
need, you could just simply discard it.
So most of the time, as a general practice, most
of the corporate environments do have that practice in place.
If you join a company, they probably have something,
a template of a system that tells you hey,
these are the package that should be installed.
And these are package should not be installed. Perfect.
You're in a perfect world, you get in awesome.
But what if you get into a job and
they don't have that type of standard or template?
Then, then it's a time for you to shine.
Basically, this is your opportunity.
Go to your manager, tell them hey, listen,
I noticed that we are installing every package
in the system and we should not.
So let's remove them.
Also, one of the great things every great
manager asks you when you go for an
interview, how do you make your system secure?
And if you answer I will remove
all unnecessary packages or orphan packages,
you'll score it right there.
You'll understand where you're coming from.
Anyway, go back to the point and make sure you have
a list of all packages, go through them and remove them.
To remove packages, the command you would have to use
is rpm -e to erase and package name.
And then of course, rpm is the command of Redhat or
CentOS. For Ubuntu type of Linux distribution,
you have to use app-get, which is app
hyphen get space remove and space
package name. Both performs the same function, as
long as you get the desired result.
Now, about orphan packages, what are those?
Let's talk about them.
The objective is to remove all
orphan packages from CentOS Linux.
By orphan packages we mean all packages which are
no longer serve a purpose of a package dependencies.
For example, let me give you a quick
example so you will have a better understanding
what exactly the above paragraph means. Package A,
any package called a package A
is dependent on package B.
Thus, in order to install package A, package
B must be installed and required. Understood.
Once package A is removed, package
B might still be installed.
Do you see that?
Therefore the package B is now orphan package.
So you have removed package A, but package B was
required to have a package A, but now since package
A is gone, you don't need package B, right?
So those packages that classify in package B
are orphan packages and you should delete them.
Now how do you identify those packages? Good question.
Moving on, there is a built in utility
which allows you to check for orphaned packages
in your Linux machine. For CentOS type of
Linux distributions or CentOS or Redhat,
that utility is called yum utilities,
of course it's in rpm packages as well.
If you have that installed, then it means you have
that command that I'm going to show you right now.
Check if that exists in your system.
Meaning check if the dependency, sorry orphan
packages exist in your system.
Sorry, let me take one step back.
What I meant is check if that utility yum-utils exists
in your system, is to run Rrpm -qa | grep yum-utils
If that package is there, then it means
you don't have to download or install it.
But what if it does not exist?
Then simply you could do yum install yum-utils.
Okay, so once you have that
installed, let's suppose you have it,
now the next question is get a list of all
orphaned packages and that is package-cleanup -leaves.
It will give you everything, all
the orphaned packages in your system.
Once you identify them, what do you need to do?
You need to remove them.
Of course you could do rpm -e, or you
could simply use this command which is a lot easier.
yum remove `package-cleanup -leaves`
the same command that we ran earlier,
but of course with backticks.
Backticks are the one that is
right below your escape key.
And of course for Ubuntu system type of systems,
all you have to do is app-get autoremove,
and it will do all the job for you.
All right, so that's about
removing unnecessary or orphaned packages.
Now I want you to actually log into your Linux system
and follow the way I'm going to log into my system
and I'm going to go through these few commands.
So I have my Linux machine right here.
And first of all, I'm going to check
the list of all the packages that I
have, which we covered in the last slide.
So I'm going to do more and
look at how many packages I have.
Now if I want to count how many file I
have, I could do simply rpm -qa | wc -l, and
it's going to tell me I have 1411 packages.
No kidding. Yes, that is a high number.
But anyway, as I said, what you have to do is you
have to output to a file like /tmp/system-rpms. It
creates a file and outputs by getting the output of rpm -qa..
Then you go through all those packages, as I
said, one by one, and you delete them.
Now, the next command is to
remove rpms or remove orphan packages.
And for the utility, you need to have the utility.
And to find out whether you have
that utility, run rpm -qa | grep yum-utils.
Yes, I do have it. Perfect.
I don't have to install it.
If I didn't, then you would have to install it.
Now, the next one is clean up
to check all the offered packages.
So package-cleanup --leaves.
By the way, it's --leaves not just
one single hyphen, it's two hyphens. There you go.
So it's give me all these
listed listing of those packages.
By the way, how many we have,
wc -l, eight of them.
So I want to get rid of them. Perfect.
So how do I do that?
Simply run yum remove backticks, backticks close, and hit enter.
And it is going to remove all
those packages that are listed above. There you go.
It's going through that. It's just asking
you want to go ahead and remove it?
Yes, I wanted to go ahead and remove it.
Erasing, erasing, erasing, and so on and so forth.
And it is completed.
Now, if you run that same
command, it shouldn't give you any.
If it does, then you could run these commands a
few more times to make sure you have a fully
complete system that is free of all orphan packages.
Anyway, so that's how you do remove unnecessary and orphan packages.
Again, if you have any questions, please send
me a message and I'm always here to
answer any questions you guys have. Thank you.
[No audio]