How to Update a Debian Server

This guide explains how to update the packages on your Debian server, how to tell whether a reboot is needed and how to have security updates installed automatically. Upgrading to a new major version (for example from Debian 12 to 13) is not covered here.

Which version are you using?

cat /etc/os-release

The PRETTY_NAME line shows the version, for example Debian GNU/Linux 12 (bookworm).

Support status of the versions

LTS is run by Debian volunteers and covers the common architectures (amd64 included). Extended support beyond LTS (ELTS) is not an official Debian project; it is a paid service from Freexian.

Before you start

• Run the commands as root or with sudo.
• Take a backup. Backups are the customer's responsibility; for your server you can use our backup services or take a copy of the whole server with the System Copy add-on.
• Choose a quiet time. Some services restart during the update, and a kernel update needs a reboot.
• If you lose your SSH connection, you can still reach a VDS server from the console in the client area: Using the Console on a VDS Server.

Installing updates

1. Refresh the package lists. This only downloads the list of available versions; it does not install anything:

   apt update

2. If you want, see which packages will be upgraded:

   apt list --upgradeable

3. Install the updates:

   apt upgrade

   The command shows what it will do and asks for confirmation; press Y and Enter. apt upgrade never removes a package: if an update needs a package to be removed, that update is held back.
4. If some packages were held back, you can install them with:

   apt full-upgrade

   full-upgrade may remove packages when that is needed to upgrade the system as a whole. Read the list it shows before you confirm.

If a question comes up about a configuration file you changed earlier (for example SSH or a web server setting), the safe choice when you are not sure is to keep the version currently installed; this is the default answer.

Is a reboot needed?

A new kernel only takes effect after a reboot. Check with:

ls /var/run/reboot-required && cat /var/run/reboot-required.pkgs

If the file exists, a reboot is needed; the second file lists the packages that asked for it. On Debian this file is written by the unattended-upgrades package (see below); if it is not installed, the file may not appear even after a kernel update. In that case use needrestart.

needrestart shows whether the running kernel is outdated and which services still use old libraries:

apt install needrestart
needrestart -k
needrestart -r l

-k only checks the kernel; -r l only lists services without restarting them. To reboot the server: reboot. You can also use Restart in the client area.

Installing security updates automatically

unattended-upgrades installs security updates automatically every day. Install and turn it on:

apt install unattended-upgrades
dpkg-reconfigure unattended-upgrades

Answer Yes to the question. This creates /etc/apt/apt.conf.d/20auto-upgrades; with these two lines, the lists are refreshed and updates installed every day (0 turns it off):

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

By default only security updates are installed automatically, and the server is not rebooted. If you want an automatic reboot when needed, you can set this in /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

To test the settings: unattended-upgrade -d. What was installed is logged in /var/log/unattended-upgrades/.

Versions that are no longer supported

Debian 11 and earlier no longer receive free security updates. The packages of Debian 9 and 10 have been moved from the normal mirrors to archive.debian.org, so apt update fails with "404 Not Found" errors on these servers. The archive lets you install packages, but no new security fixes arrive there.

For a server that stays on the internet, the lasting solution is to move to a supported version (Debian 13 or 12). If you would like your server reinstalled with a current version, you can open a support ticket from your client area.

Troubleshooting

• "Could not get lock /var/lib/dpkg/lock-frontend": another update is running (often the automatic one). Wait a few minutes and try again; do not delete the lock file.
• The update was interrupted: finish it with dpkg --configure -a, then run apt upgrade again.
• The server does not come back after a reboot: open the console in the client area and check the screen (Using the Console on a VDS Server). If you cannot solve it, you can open a support ticket from your client area.

The information in this guide is taken from official documentation: Debian Releases, Debian LTS, Debian Archive, apt(8), Debian Wiki: UnattendedUpgrades, needrestart(1).