Inspect Debian Debconf Databases Using debconf-utils

This article explains the purpose of the debconf-utils package in Debian and demonstrates how its core utilities allow system administrators to inspect, query, and analyze stored debconf configuration databases. By using tools such as debconf-get-selections, debconf-show, and debconf-dump, administrators can audit package configuration states, verify automated installation answers, and troubleshoot package management behaviors across Debian-based systems.

What is debconf-utils?

Debconf is Debian’s standardized configuration management system. During package installation or reconfiguration, debconf prompts users for input and stores the responses in a central database (typically located in /var/cache/debconf/).

While standard debconf tools handle the interactive prompting and backend storage, the debconf-utils package provides specialized, command-line utilities specifically designed for querying, backing up, and manipulating this database. It is essential for administrators who need to automate installations via preseeding, audit system configurations, or diagnose issues with package templates and stored values.

To install the package on Debian:

sudo apt update
sudo apt install debconf-utils

Core Commands for Inspecting Debconf Databases

debconf-utils includes several key commands designed to read and present the contents of debconf databases in structured, human-readable formats.

1. debconf-get-selections

The debconf-get-selections command extracts all questions and their current answers from the debconf database and outputs them in a standardized preseed format.

View the entire debconf database:

sudo debconf-get-selections

The output follows a four-column format:

<package-name> <question-template> <type> <value>

Filter by a specific package: Combine the command with grep to inspect configurations for a single package:
```
sudo debconf-get-selections | grep postfix
```
Inspect Debian Installer (d-i) questions: If run on a system installed via the Debian Installer, you can extract installer-specific parameters:
```
sudo debconf-get-selections --installer
```

This output is directly compatible with preseed files used for fully automated operating system deployments.

2. debconf-show

The debconf-show utility provides a quick, package-centric view of configuration settings. Unlike debconf-get-selections, it targets an individual package and displays all known templates associated with it.

Usage:
```
sudo debconf-show <package-name>
```
Example:
```
sudo debconf-show tzdata
```
Interpreting the Output:
- An asterisk (*) before a template name indicates that the question has been seen and answered by an administrator or default configuration script.
- Absence of an asterisk indicates an unanswered question that currently uses a default value or has not yet been presented.

3. debconf-dump

The debconf-dump command performs a direct, low-level dump of the debconf database files. It is useful for reviewing the raw metadata, including internal debconf flags, template definitions, and localized strings.

Inspect the primary configuration database:

sudo debconf-dump /var/cache/debconf/config.dat

Inspect the templates database:

sudo debconf-dump /var/cache/debconf/templates.dat

This outputs data in RFC 822-style stanzas, separating each record with an empty line. It is primarily used for debugging low-level database corruption or verifying database integrity.

Common Administrative Use Cases

System Cloning and Preseeding: Generating baseline configuration files using debconf-get-selections > preseed.cfg ensures identical package configurations across multiple nodes in an infrastructure.
Troubleshooting Reconfigurations: If running dpkg-reconfigure <package> does not present expected prompts, debconf-show reveals whether the questions are marked as already seen or set to priority levels higher than the debconf frontend threshold.
Compliance Auditing: Comparing outputs from debconf-get-selections across production servers helps detect unauthorized or inconsistent configuration drift across environments.