How to use the command debsecan (with examples)

Debsecan is a Debian Security Analyzer tool that is used to list vulnerabilities on a particular Debian installation. It provides valuable information about vulnerable packages and allows users to take appropriate actions to ensure the security of their systems.

Use case 1: List vulnerable installed packages on the current host

Code:

debsecan

Motivation: This use case allows users to quickly check for any vulnerable installed packages on their current Debian host. It is essential to regularly scan and identify vulnerabilities to maintain the overall security of the system.

Explanation:

• The debsecan command, when executed without any additional arguments, lists all the vulnerable packages installed on the current host.

Example output:

Packages with vulnerable versions:
libc6 2.31-1

Use case 2: List vulnerable installed packages of a specific suite

Code:

debsecan --suite release_code_name

Motivation: In some cases, it is necessary to check for vulnerabilities specific to a particular suite of Debian. This allows users to focus on vulnerabilities relevant to their environment.

Explanation:

• The --suite argument is followed by the release code name of the specific suite (e.g., “buster”) to list vulnerabilities for that suite.

Example output:

Packages with vulnerable versions:
package1 vulnerability1
package2 vulnerability2

Use case 3: List only fixed vulnerabilities

Code:

debsecan --suite release_code_name --only-fixed

Motivation: By listing only fixed vulnerabilities, users can prioritize updating and patching their systems. This helps to ensure that all known vulnerabilities have been addressed.

Explanation:

• The --only-fixed argument filters the output to show only fixed vulnerabilities, meaning vulnerabilities for which updates or patches are available.

Example output:

Fixed vulnerabilities in the specified suite:
package1
package2

Use case 4: List only fixed vulnerabilities of unstable (“sid”) and mail to root

Code:

debsecan --suite sid --only-fixed --format report --mailto root --update-history

Motivation: This use case demonstrates advanced options of debsecan, combining multiple arguments. By listing only fixed vulnerabilities for the unstable (“sid”) suite and sending a report to the root email, administrators can stay updated on the security status of their systems.

Explanation:

• The --suite sid argument specifies the suite to be checked as “sid,” which represents Debian’s unstable distribution branch.
• The --format report argument formats the output as a report.
• The --mailto root argument sends the report to the root email address.
• The --update-history argument includes information about the update history of each vulnerability.

Example output:

Report - Vulnerabilities fixed in sid:
package1 vulnerability1
package2 vulnerability2

Update history:
package1 vulnerability1 - fixed in version 1.2.3
package2 vulnerability2 - fixed in version 4.5.6

Use case 5: Upgrade vulnerable installed packages

Code:

sudo apt upgrade $(debsecan --only-fixed --format packages)

Motivation: This use case demonstrates a practical approach to upgrade vulnerable installed packages based on the output provided by debsecan. By automating the upgrade process, users can easily apply necessary updates and patches to mitigate security vulnerabilities.

Explanation:

• The subcommand debsecan --only-fixed --format packages is enclosed in $() to capture the output, which will be used as an argument for the apt upgrade command.
• The apt upgrade upgrades vulnerable packages to their fixed versions.

Example output:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  package1 package2
2 upgraded, 0 newly installed, 0 to remove, and 0 not upgraded.
Need to get 100 kB of archives.
After this operation, 50 kB disk space will be freed.
Do you want to continue? [Y/n] Y

Conclusion:

Debsecan is a powerful command-line tool for assessing the security status of a Debian installation. It allows users to identify vulnerable packages, prioritize updates, and automate the upgrade process. By utilizing the various options and arguments provided by debsecan, administrators can effectively maintain a secure and up-to-date Debian system.