Ubuntu server - how to keep updated / install security updates

trafikpolisen · 03-06-2021, 06:18 AM

Hi!
I'm preparing to install a new home server for primarily storage and also for running a few VM's. I will use either Ubuntu Server or Debian. But I would prefer Ubuntu for its long term support. But when I try to find good solid information on how to keep the system up to date, it's like i can't find anything (official). If I for example, search for "debian keep updated", the first search result is to a relevant chapter in the Debian documentation, but if I instead search for "ubuntu server keep updated", nothing official pops up. Why is this? You'd think this would be a rather important topic. If I turn to the Ubuntu Server official documentation (https://ubuntu.com/server/docs), I can't find updates and/or security updates mentioned. During installation of Debian, I get to choose whether to do automatic updates or not, but during the Ubuntu server installation, no such option is available (and not many other options either, for that matter). Can someone shed some light on this?

wpeckham · 03-06-2021, 07:49 AM

It is far more simple than you are making it.
Seek "upgrade system ubuntu" (or debian) and you will find pointers to the apt command. It takes two lines, one to update the local copy of the software catalog and one to search the catalog against installed packages and generate the required downloads and installs. Those lines look like

Code:

sudo apt update
sudo apt upgrade

.

If there is a major upgrade available, there may be advantage in running

Code:

sudo apt dist-upgrade

in the place of the "sudo apt upgrade" line.

You can use the GUI application instead if you wish, but I personally never install a gui on a server by choice. (Why waste cycles to run a pretty GUI interface that you are never looking at, save those cycles for your services.)

You do want to run these manually, rather than in a script. Updates are the most likely time for something to be detected that you need to react to, or for something to go wrong if you force it to continue without human evaluation.

Pentium4User · 03-07-2021, 12:31 AM

You can set up unattended-upgrades.
Be aware that the default setting from it is only to install from focal-security (if you use 20.04 Focal Fossa) and not from other sources (no focal-updates, focal-partner etc) and also not from 3rd party repos and PPA, but you can change this.

You have to change the files

Code:

mm@mm:~$ cat /etc/apt/apt.conf.d/20auto-upgrades 
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
mm@mm:~$

Code:

/etc/apt/apt.conf.d/50unattended-upgrades 

##Only the relevant part
###
Unattended-Upgrade::Allowed-Origins {
	"${distro_id}:${distro_codename}";
	"${distro_id}:${distro_codename}-security";
	// Extended Security Maintenance; doesn't necessarily exist for
	// every release and this system may not have it installed, but if
	// available, the policy for updates is such that unattended-upgrades
	// should also install from here by default.
	"${distro_id}ESMApps:${distro_codename}-apps-security";
	"${distro_id}ESM:${distro_codename}-infra-security";
	"${distro_id}:${distro_codename}-updates"; ###for focal-updates (non-security related bugfixes)
//	"${distro_id}:${distro_codename}-proposed";
	"${distro_id}:${distro_codename}-backports";

};
# install from all other repos 
Unattended-Upgrade::Origins-Pattern {
    "origin=*";
};

trafikpolisen · 03-12-2021, 12:57 PM

Thank you for your answers! I am aware of and reasonably familiar with apt(-get) and how to update with that. And if I google for how to keep Ubuntu updated, "apt-get upgrade" indeed pops up in various guides and forums. What I find odd is that there doesn't seem to be any official documentation on how to keep Ubuntu up to date. There is a page on automatic security updates, but not on updates in general.
I have anyway decided to go with Ubuntu Server for the great long term support.

shruggy · 03-12-2021, 01:20 PM

Quote:

Originally Posted by trafikpolisen

What I find odd is that there doesn't seem to be any official documentation on how to keep Ubuntu up to date.

Ubuntu Server Guide has a chapter on package management. So does the Debian Administrator's Handbook.