Auditing Debian Software with apt-mark showmanual

This article examines how the apt-mark showmanual command serves as a critical auditing tool for administrators on the Debian operating system. It covers the distinction between manual and automatic package installations, explains how to filter system noise to identify operator-installed software, and outlines practical methods for maintaining system security, tracking configuration drift, and preparing for server migrations.

The Distinction Between Manual and Automatic Packages

The Advanced Package Tool (APT) maintains a database tracking the installation state of every package on a Debian system. When a package is added, APT classifies it using one of two internal flags:

  • Automatic (auto): Packages pulled in automatically to satisfy dependency requirements of other software.
  • Manual (manual): Packages that were explicitly requested by a system administrator or an automated provisioning script via commands like apt install <package>.

The apt-mark showmanual command reads this database and prints a newline-delimited list of all packages marked as manually installed.

Why Standard Listing Commands Fall Short for Auditing

Traditional Debian inspection tools like dpkg -l or dpkg-query output every package present on the system. On a standard Debian server, this typically results in a list of over a thousand packages, the vast majority of which are shared libraries, system utilities, and transient dependencies.

Auditing with dpkg -l makes it difficult to distinguish between essential OS components and software introduced by administrators. By filtering out automatically resolved dependencies, apt-mark showmanual reduces this output to a targeted list of packages that were deliberately chosen, significantly reducing the surface area an auditor must review.

Key Auditing Applications

1. Identifying Unauthorized or Forgotten Software

Over time, servers experience configuration drift as administrators install debug tools, editors, or alternative services during maintenance. Running apt-mark showmanual exposes these additions, allowing teams to verify that every user-installed package conforms to security baselines and organizational policies.

2. Streamlining System Replication and Migrations

When migrating workloads to a new server or defining Infrastructure-as-Code (IaC) templates, administrators should only specify top-level requirements rather than hardcoding entire dependency trees. Capturing the output of apt-mark showmanual provides the exact package list needed to rebuild the environment on a clean installation:

apt-mark showmanual > manual-packages.txt

On the target system, this list can be used to install the required applications while allowing the new OS to resolve the appropriate, updated dependencies automatically.

3. Cleaning Up Orphaned Packages

If an administrator manually installs a package that is later no longer needed, changing its flag back to automatic allows APT's garbage collection to clean up both the package and its orphaned dependencies:

sudo apt-mark auto <package-name>
sudo apt autoremove

Auditing the manual list helps identify packages that are no longer in active use, enabling effective disk space reclamation and reducing the overall attack surface.

Advanced Usage in Security Audits

While apt-mark showmanual isolates operator-requested packages, the initial Debian installation process also marks baseline system packages as manual. To isolate only the packages installed after the base OS was deployed, administrators can compare the current manual list against a baseline reference system using comm:

comm -23 <(apt-mark showmanual | sort) <(cat baseline-manual.txt | sort)

This output yields the precise set of software introduced over the server's lifecycle, providing an actionable inventory for compliance checks, vulnerability management, and security reviews.