I am trying to create a minimal install of Ubuntu Server 14.04.3. I selected the "minimal" option during installation.
My system now has two meta packages, ubuntu-minimal and ubuntu-standard. The latter contains many packages which go above and beyond what I would consider a "minimal" installation for a server e.g. telnet and ftp clients.
I would like to remove some of these packages however doing so will also remove the metapackage. The description of ubuntu-standard contains the following warning:
It is also used to help ensure proper upgrades, so it is recommended that it not be removed.
I can find little information on what this actually means. The best I've come up with is this answer, which suggests that the removal of a metapackage will cause problems when upgrading to a new version of Ubuntu.
Other than when upgrading to new versions of Ubuntu, are there any other consequences of removing a metapackage? Is it possible that a package could be added to or removed from the metapackage for security reasons, that I would miss out on in the absence of the metapackage? E.g. it is decided that Package X should now be part of ubuntu-standard to fix some newly discovered security issue. Will the update process of any remaining packages on my system be unaffected?
Of course you could. A metapackage is just a convenient way of bundling packages. Sure, they may come with stuff you don't immediately or ever need, but if at some point you decide that you need a desktop environment after all, you'll be happy about
ubuntu-desktopor the like.That said, I don't see any good reason why you should do so. Looking at the dependencies of
ubuntu-standard, I find the vast majority of packages it installs are quite essential. Especially for administrating a system from the command line. The fact that you don't need an ftp client today, doesn't mean you won't need one in the future.Furthermore, those aren't large packages.
ftptakes about 140kB disk space. If the available space is that constraint, I think Ubuntu is not the right distribution for your needs.Finally, if in a year or so you decide to upgrade to
16.04 LTS, you'll find yourself reinstalling that metapackage to make the release upgrade work.Actually, there is one other thing. The packages installed through a metapackage are marked
automatically installed. Meaning, if the metapackage is removed, the package system will suggest them for autoremoval unless you mark them asmanually installed. Although I believe that is not the case for metapackages installed at system setup, only for those installed later. Take a look yourself and see if e.gftpis marked auto or not:apt-mark showauto | grep ftpIn principle, if the dependencies of a metapackage change, you will miss out on those changes. You will still receive updates for the currently installed packages though, depending on which repositories are enabled.
If this happens in practice except with new releases I do not know, but I doubt it. The only prominent counterexample I can think of are the kernel metapackages. They will (on the desktop releases anyway) always point to the latest available kernel. Removing the metapackages will prevent new kernels from being installed. That may be wanted, but the better solution would be to hold the metapackage.
In my opinion you likely won't break anything, so I can't advise against it absolutely. But personally I don't think it worthwhile. At least not regarding such small and yet very handy tools.
Addendum: OP makes a compelling point in the comments below. Security must be taken very seriously especially in a server setting. Minimizing attack vectors includes getting rid of unneeded and unwanted software. If you find a piece of software that poses a potential security risk and is not necessary, by all means get rid of it!
On a server running a sensitive service, say Kerberos, I think it's really best practice to strip the system down to the essentials.
That said, since the question is about
ubuntu-standard, I didn't see any harm with the packages installed. So I stand by my opinion :-)