DEBSECAN(1)

💖 DEBSECAN — Debian Security Analyzer 💖

okay bestie, sit down, hydrate, because we're about to talk about debsecan and honestly? it's giving main character energy in the "keeping your Debian box from getting wrecked" department. it's the Debian Security Analyzer, it's a section 1 manual page, and it is so much cooler than it sounds.

---

✨ NAME ✨

debsecan — Debian Security Analyzer. that's it, that's the girl. 🎀

---

🌸 SYNOPSIS 🌸

debsecan options...

yeah that's the whole thing, she takes options, she does the work, she slays. 💅

---

🦋 DESCRIPTION 🦋

so what does debsecan actually do? she looks at the list of installed packages on the current host — your host, right now, the one you're on — and she reports the vulnerabilities found on the system. that's it. that's the vibe check. she reads your packages, she tells you what's vulnerable. no cap. 😭

---

💜 OPTIONS 💜

• --suite count — pick a specific suite. listen, if you tell her the right suite, debsecan gives you way more informative output (obsolete packages included, hooray 🎉). but here's the thing: you have to use the release code name — so "sid" — and not the temporal name, so not "unstable". she said what she said.
• --whitelist file — change the name of the whitelist file. new file, new you. 🫶
• --add-whitelist, --remove-whitelist, --show-whitelist — add entries to the whitelist, remove entries from the whitelist, or print the whitelist to standard output. three icons, one job. see the CHANGING THE WHITELIST section below bestie, it's right there. ⭐
• --source url — override the default download URL for vulnerability data. custom source, custom era. 🌈
• --status file — evaluate a different dpkg status file. not the usual one, a different one. 👑
• --format format — change the output format, and honestly there are so many options:
  • if format is summary (which is the default), you get a short summary for each vulnerability.
  • simple is like summary, except only the bug packages names get printed. minimal, clean, aesthetic. ✨
  • bugs and packages: for these, debsecan lists the names of vulnerabilities and binary packages, respectively.
  • --format detail requests a verbose output format, showing all available data. all of it. the whole lore. 💀
  • report is the format used for email reports.
• --line-length characters — specifies the line length in report mode. the default is 72. respect the margin bestie. 📏
• --mailto mailbox — the --mailto option instructs debsecan to send the report to the email address mailbox. no report is sent if there were no changes since the last invocation with --update-history. this option requires the --format report output format. the option value may contain macros — see the CONFIGURATION FILE MACROS section below. 💌
• --only-fixed — only list vulnerabilities for which a fix is available in the archive. > heads up bestie: it can happen that a fix is listed even though the package has not been built for the system's architecture and is not yet available for download. and also: if you use this option, you also must specify the correct suite using --suite. both things. no skipping. 🙈
• --no-obsolete — do not list any obsolete packages (see below). using this option is not recommended, because it hides real vulnerabilities on some systems, not just false positives. so like, it's a vibe but it's a lying vibe. 🚩
• --history file — change the name of the history file used by --format report.
• --disable-https-check — turn off certificate validation for HTTPS. yes, really, that's what it does. 😭
• --update-history — update the vulnerability status information after reporting it using --format report.
• --cron — internal option used for invocations from cron. it checks if the vulnerability data has already been downloaded today, and in that case, further processing is skipped. see debsecan-create-cron(8) for instructions on how to create a suitable cron entry. 🕰️
• --config file — sets the location of the configuration file.
• --help — display a short help message and exit. she's helpful, she's brief, she's gone. 💨
• --version — display version information and exit. know your queen's birthday. 👑

---

🎀 CONFIGURATION FILE 🎀

the configuration file contains the following variables. it follows name=value shell syntax. if value contains white space, it must be surrounded by double quotes. some variables may contain macros — see the CONFIGURATION FILE MACROS section below. ✨

• MAILTO — sets the email address to which reports are sent in --cron mode. may contain macros.
• REPORT — controls whether debsecan does any processing whatsoever in --cron mode. permitted values: true and false. so basically yes or no, queen. 💅
• SOURCE — controls the URL from which vulnerability information is fetched. if empty, the built-in default is used.
• SUITE — sets the default value of the --suite option (see there).
• SUBJECT — changes the subject line of reports. may contain macros. 📧
• DISABLE_HTTPS_CHECK — disables HTTPS certificate checking, just like the --disable-https-check command line option. twins. 👯

---

🌈 CONFIGURATION FILE MACROS 🌈

macro processing replaces strings of the form %s(key)s with system-dependent values. the supported keys are:

• hostname — the host name on which debsecan runs, without the domain name part. just the first name, no last name, we're casual here. 🫶
• fqdn — the fully-qualified domain name of the host on which debsecan runs. the full government name. 👑
• ip — the IP address of the host on which debsecan runs. > note: this may be inaccurate on multi-homed systems. she said it, not me. 😭

---

💅 CHANGING THE WHITELIST 💅

you can use the --add-whitelist and --remove-whitelist options to change the whitelist. whitelisted vulnerabilities are not included in the reports. so basically it's the "we don't talk about that one" list. 🤫

for example,

debsecan --add-whitelist CVE-2005-4601

ignores the vulnerability CVE-2005-4601 completely. completely completely. 💀

while

debsecan --add-whitelist CVE-2005-4601 perlmagick

ignores it only as far as the perlmagick is concerned. (this is the same format that is produced by the --format simple option.) so specific. so targeted. we love a precise queen. ✨

to remove all whitelist entries for the CVE-2005-4601 vulnerability, use:

debsecan --remove-whitelist CVE-2005-4601

if you want to remove an entry for a specific vulnerability/package pair, list the package name explicitly, as in:

debsecan --remove-whitelist CVE-2005-4601 imagemagick

you can list multiple vulnerability and packages. for example,

debsecan --add-whitelist CVE-2005-4601 \
   CVE-2006-0082 imagemagick perlmagick

whitelists CVE-2005-4601 for all packages, and CVE-2006-0082 for the imagemagick and perlmagick packages only. see? she's flexible. she contains multitudes. 🦋

---

💀 CAVEATS 💀

okay bestie, this is the part where we get real. buckle up.

much like the official Debian security advisories, debsecan's vulnerability tracking is mostly based on source packages. this can be confusing because tools like dpkg only display binary package names. therefore, debsecan displays the more familiar binary package names. this has the unfortunate effect that all binary packages (including packages containing only documentation, for example) are flagged as vulnerable, and not only those packages which actually contain the vulnerable code. > so yeah, docs-only packages catching strays. it's not personal, it's structural. 😭

if the correct --suite option is specified, debsecan may mark some packages as obsolete. this means that the binary package in question has been removed from the archive. in this case, you need to update all the packages depending on the obsolete package, and subsequently remove the obsolete package. do it in that order bestie, i'm begging. 🚩

for certain architectures, build daemons may lag considerably. in such case, debsecan may incorrectly mark a package as fixed, even if an update is not yet available in the Debian archive. the build daemons are simply not beating the allegations. 💀

note that debsecan version uses the --suite option only to determine the availability of corrected packages and to detect obsolete packages. so if you specify the wrong suite, only the information on available security updates and obsolete packages is wrong — but the list of vulnerabilities is correct. so like, half wrong, half iconic. 🌈

mixing packages from different Debian releases is supported, as long as the packages still carry their official version numbers. unknown package versions (from backported packages, for example) are compared to the version in Debian unstable only, which may lead to incorrect reports. > you've been warned. 📢

---

⭐ EXAMPLES ⭐

this command prints all package names for which security fixes are available:

debsecan --suite suite --format packages --only-fixed

if you pass this output to apt-get, you can download new packages which contain security fixes. for example, if you are running sid:

apt-get install \
   $(debsecan --suite sid --format packages --only-fixed)

look at that. pipeline. automation. main character energy. 🔥

the following command can be invoked periodically, to get notifications of new security issues:

debsecan --suite suite --format report \
   --update-history --mailto root

see debsecan-create-cron(8) for a tool which creates a suitable cron entry. she'll handle the schedule, you handle the vibes. 🕰️✨

---

🌸 ENVIRONMENT 🌸

• https_proxy — this environment variable instructs debsecan to use a proxy server to fetch the vulnerability data. it must be of the form http://proxy.example.net:8080/ (mimicking a URL). yes, it's pretending to be a URL, that's the bit. 🎭

---

🎀 FILES 🎀

• /etc/default/debsecan — built-in location of the configuration file.
• /var/lib/dpkg/status — file from which the package information is fetched by default.

---

👑 AUTHOR 👑

debsecan was written by Florian Weimer. thank you for your service king. 🫡

---

💜 SEE ALSO 💜

dpkg(1), debsecan-create-cron(8), apt-get(8) — go read those too bestie, they're in the group chat. 📚

---

and that's the whole page!! dated 2005-12-23, from the DEBSECAN(1) manual, and honestly it's aged like fine wine. go secure your packages, you absolute icon. slay, stay patched, and never skip the whitelist section. 💖🦋✨