Package management with apt

Module 4: Software and updates · Reading time: 10 minutes

Learning objective: After this lesson you can install, update and remove software with apt, see where a package comes from and recognise which updates are security updates.

Key concepts: package, package source (repository), sources.list, .sources file (deb822), signed-by, apt update, apt upgrade, apt full-upgrade, remove, purge, autoremove, apt-cache policy, security source, dnf

Why a package manager?

On Windows you download an installer from a website. On a Linux server you almost never do that. Software comes as a package from a package source (repository): a server run by the distribution with thousands of programs, all built and tested for your version of Debian or Ubuntu. The program that fetches, installs and updates those packages is called the package manager. On Debian and Ubuntu that is apt (with dpkg underneath), on AlmaLinux and Rocky Linux it is dnf.

This has three big advantages:

1. One command updates everything. The web server, the SSH server, the libraries and the kernel all come from the same source. You don't have to check a website for each program to see whether there is a new version.
2. The origin is verified. Every package source is signed with a key. apt refuses packages whose signature doesn't match.
3. Dependencies are handled for you. If nginx needs a library, apt installs it automatically and cleans it up again later.

The package sources: where does it come from?

The sources apt uses are listed in /etc/apt/. For a long time that was a single file, sources.list, with lines like:

deb http://deb.debian.org/debian bookworm main

Ubuntu 24.04 and later, Debian's cloud images and more and more new installations use the newer deb822 format: separate files with the extension .sources in /etc/apt/sources.list.d/. You can convert an old sources.list with sudo apt modernize-sources (apt 3, Debian 13). For example, on Debian 13:

anna@web1:~$ cat /etc/apt/sources.list.d/debian.sources
Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://deb.debian.org/debian-security
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Read it like this: the suite is the version (trixie is Debian 13; noble is Ubuntu 24.04), the component is a part of the source (main on Debian; main, universe, restricted and multiverse on Ubuntu), and Signed-By says which key the source must be signed with. That last part matters: a key belongs to one source, not to all sources at once. If you later add a source from a vendor (Docker, Caddy, PostgreSQL), it gets its own key file and its own Signed-By line (lesson 9.2).

The source with -security in its name is the security source. That is where security updates come from, usually on the same day a vulnerability becomes known. On Ubuntu that suite is called noble-security (or the name of your version).

If you still use the old sources.list, everything works just fine. Just don't list the same source in both formats, or apt will complain about duplicate entries.

update, upgrade and full-upgrade

The difference between these three is the first pitfall for beginners.

So always run update first, then upgrade:

anna@web1:~$ sudo apt update
Hit:1 http://deb.debian.org/debian trixie InRelease
Get:2 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
...
3 packages can be upgraded. Run 'apt list --upgradable' to see them.
anna@web1:~$ apt list --upgradable
Listing... Done
libssl3t64/trixie-security 3.5.1-1+deb13u1 amd64 [upgradable from: 3.5.1-1]
openssh-server/trixie-security 1:10.0p1-7+deb13u1 amd64 [upgradable from: 1:10.0p1-7]
tzdata/trixie-updates 2026b-0+deb13u1 all [upgradable from: 2026a-0+deb13u1]

(The version numbers above are an example.) After the name you see which suite the new version comes from. Anything with -security is a security update: you want those as soon as possible. -updates are other stable updates, such as new time zone data.

Then:

anna@web1:~$ sudo apt upgrade

apt shows what will change and asks for confirmation. Read that list. If it says "The following packages will be REMOVED", something unusual is going on and you want to know why first.

Installing, removing and cleaning up

anna@web1:~$ sudo apt install nginx
anna@web1:~$ sudo apt remove nginx       # program removed, config in /etc stays
anna@web1:~$ sudo apt purge nginx        # program and config removed
anna@web1:~$ sudo apt autoremove         # clean up what nothing needs anymore

The difference between remove and purge is useful: if you want to remove something temporarily and reinstall it later with the same settings, use remove. If you really want a clean start, use purge.

Searching and more information:

anna@web1:~$ apt search fail2ban
anna@web1:~$ apt show fail2ban
anna@web1:~$ apt-cache policy openssh-server
openssh-server:
  Installed: 1:10.0p1-7
  Candidate: 1:10.0p1-7+deb13u1
  Version table:
     1:10.0p1-7+deb13u1 500
        500 http://deb.debian.org/debian-security trixie-security/main amd64 Packages
 *** 1:10.0p1-7 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages

apt-cache policy is the command to use when you want to know where a package comes from and which version apt will choose. The *** marks the installed version, Candidate is what an upgrade would install.

Debian versions and the version of a program

A common complaint: "Debian ships an old version of nginx." That's true, and it's deliberate. Debian and Ubuntu freeze versions when a release comes out and after that only add security fixes and serious repairs, without new features. That's why a package with an "old" version number can still have all recent security fixes: they have been backported into the old version. You can recognise this by the suffix, such as +deb13u1 or ubuntu0.1.

So never compare just the version number with the vendor's website to judge whether you are vulnerable. Check your distribution's security announcements: the Debian Security Tracker (security-tracker.debian.org) and the Ubuntu Security Notices (ubuntu.com/security/notices) tell you per vulnerability whether your version has been fixed.

A few rules for a calm server

• Install only what you need. Every package is code that needs updating and sometimes a service that listens (lesson 5.1).
• Prefer the distribution over a website. A program you compile yourself or download as a separate file is not updated by apt upgrade. You then have to follow the security announcements yourself.
• Add an extra source only from the vendor itself, with its own key and Signed-By. Never add a key "for everything" and never a source from an unknown website (lesson 4.3).
• Read what apt asks. During an upgrade, apt may ask whether you want to replace a modified configuration file with the vendor's new version. If you don't know what you changed, choose "keep the local version" (the default) and look at the difference later with diff: the new version sits next to it as .dpkg-dist.

On AlmaLinux and Rocky Linux

There the package manager is dnf and the packages are .rpm files. The commands resemble apt's: dnf check-update (the list), dnf upgrade (updating, update and upgrade in one), dnf install, dnf remove, dnf info. Sources are in /etc/yum.repos.d/*.repo. A lot of extra software (such as fail2ban) comes from the separate EPEL source, which you first enable with dnf install epel-release. To show only security updates, use dnf updateinfo list --security.

In practice: the VPS screen

At WebOké, and at most other providers, the installation of your VPS already sets up the distribution's standard sources correctly. You usually don't need to change anything there. Update the server straight after your first login with apt update and apt upgrade (lesson 1.2), and take a snapshot in your provider's panel before making big changes.

Summary

• On Debian and Ubuntu, software comes from signed package sources; apt fetches, installs, updates and cleans up.
• apt update only fetches the list; apt upgrade updates without removing; apt full-upgrade may also remove.
• Security updates come from the suite with -security in its name; apt list --upgradable and apt-cache policy show where a version comes from.
• An old version number with +deb13u1 or ubuntu0.x can contain all fixes (backport): check your distribution's security announcements.
• Add an extra source only from the vendor itself, with its own key in Signed-By.

Quiz

Exercise

Exercise Z4.1: Which updates are security updates? The sample file apt-upgradable.txt contains the output of apt list --upgradable and apt-cache policy from a Debian 13 server. Answer: which packages come from the security source, which package comes from a vendor's source instead of Debian, which version of openssh-server is currently installed, and which package is an ordinary stable update without a security reason? The program compares your answers with the fixed key. If you already have your own server, run the same commands and see what you get.

Further reading

• Securing your VPS: the first five minutes
• Getting started with your VPS
• The Debian Administrator's Handbook, chapter 6 (apt): https://debian-handbook.info/browse/stable/apt.html
• Manual page sources.list(5) (deb822 format): https://manpages.debian.org/trixie/apt/sources.list.5.en.html
• Debian Security Tracker: https://security-tracker.debian.org/tracker/