Package Sources

apt can only install a fix if it knows where to look. The repositories are listed in files under /etc/apt/, and an image can have the security repository disabled, commented out, or replaced with someone else's server. The benchmark (CIS 1.2.1.1, 1.2.1.2) asks you to confirm both the repositories and the keys that sign them.

Linux Mint 21

Mint keeps its list in /etc/apt/sources.list.d/official-package-repositories.list; the plain /etc/apt/sources.list is usually empty.

cat /etc/apt/sources.list.d/official-package-repositories.list

Four lines, all uncommented:

deb http://packages.linuxmint.com virginia main upstream import backport
deb http://archive.ubuntu.com/ubuntu jammy main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu jammy-updates main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu/ jammy-security main restricted universe multiverse

The Mint codename varies by point release (vanessa 21, vera 21.1, victoria 21.2, virginia 21.3); the Ubuntu base for all of them is jammy. A mirror hostname other than packages.linuxmint.com or *.ubuntu.com (or a mirror the README names) is someone else's repository. The jammy-security line is the one most often commented out on an image.

Mint 22, which the benchmark was written for, has the same file with noble in place of jammy and wilma for the Mint name.

Debian 12

grep -vE '^\s*(#|$)' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null

deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://deb.debian.org/debian bookworm-updates main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free-firmware

The security.debian.org line is the one to look for. A cdrom: line left over from installation makes apt update complain; comment it out.

Extra repositories and keys

ls /etc/apt/sources.list.d/
ls /etc/apt/trusted.gpg.d/ /etc/apt/keyrings/ 2>/dev/null
apt-key list 2>/dev/null | grep -E '^(pub|uid)'

A .list or .sources file for a PPA or a third-party site the README doesn't mention gets removed, along with its key. A signing key in trusted.gpg.d (or the old apt-key store) trusts everything that key signs from any repository, which is how a fake "update" gets installed.

sudo rm /etc/apt/sources.list.d/evil.list /etc/apt/trusted.gpg.d/evil.gpg

The GUI equivalent is Update Manager → Edit → Software Sources on Mint (the Official Repositories tab and the PPAs and Additional repositories tabs) and Software & Updates on Debian's GNOME.

Refuse unsigned packages

apt refuses a package whose signature doesn't check out unless someone told it not to care. The STIG (UBTU-22-214010) wants that made explicit, and an image can carry the opposite setting:

grep -r AllowUnauthenticated /etc/apt/apt.conf.d/
printf '%s\n' 'APT::Get::AllowUnauthenticated "false";' | sudo tee /etc/apt/apt.conf.d/01-signed-only

A file with "true" in it is removed.

File permissions and weak dependencies

The Debian benchmark also checks that nobody but root can change the source and key files (Debian CIS 1.2.1.3 to 1.2.1.9), because a user who can edit sources.list.d can point apt at their own server:

sudo chown -R root:root /etc/apt/sources.list.d /etc/apt/trusted.gpg.d /etc/apt/auth.conf.d /usr/share/keyrings
sudo chmod 755 /etc/apt/sources.list.d /etc/apt/trusted.gpg.d /usr/share/keyrings; sudo chmod 750 /etc/apt/auth.conf.d
sudo chmod 644 /etc/apt/sources.list.d/* /etc/apt/trusted.gpg.d/* /usr/share/keyrings/* 2>/dev/null; sudo chmod 640 /etc/apt/auth.conf.d/* 2>/dev/null

auth.conf.d holds repository passwords, which is why it's tighter. Each source should name its key with Signed-By: (deb822 format) or [signed-by=…] (1.2.1.1), so a key for one repository can't validate another. And at Level 2 (1.2.1.2), apt stops pulling in recommended and suggested packages, which is how unneeded software arrives:

printf '%s\n' 'APT::Install-Recommends "0";' 'APT::Install-Suggests "0";' | sudo tee /etc/apt/apt.conf.d/60-no-weak-dependencies

Verify

sudo apt update
apt policy | grep -E 'security' | head

apt update must finish with no errors and no "repository does not have a Release file" warning. apt policy lists the sources it will use; jammy-security (Mint 21) or bookworm-security (Debian) is in the list.

Example

apt update prints nothing about security. official-package-repositories.list has the jammy-security line commented out, and /etc/apt/sources.list.d/ also contains free-games.list pointing at http://203.0.113.9/ubuntu with a matching key in trusted.gpg.d. Uncomment the security line, delete the file and the key, apt update again.

Try it

1. Comment out the security line, run apt update, and notice what's missing in the output. Put it back.
2. Add a fake repository file and key, then remove them and run apt update.

Build it

A sources-check.sh that prints every uncommented deb line from every source file and any file in sources.list.d or trusted.gpg.d newer than the install date.

Next

Run Updates