How to Update an Ubuntu Server

This guide explains how to update the packages on your Ubuntu server, how to tell whether a reboot is needed and how security updates are installed automatically. Upgrading to a new release (for example from 22.04 to 24.04) is not covered here.

Which version are you using?

cat /etc/os-release

The PRETTY_NAME line shows the version, for example Ubuntu 24.04 LTS.

Support status of the versions

Ubuntu Pro (ESM) extends security updates for LTS releases to 10 years; the Legacy add-on adds 5 more years.

Before you start

• Run the commands as root or with sudo.
• Take a backup. Backups are the customer's responsibility; for your server you can use our backup services or take a copy of the whole server with the System Copy add-on.
• Choose a quiet time. Some services restart during the update, and a kernel update needs a reboot.
• If you lose your SSH connection, you can still reach a VDS server from the console in the client area: Using the Console on a VDS Server.

Installing updates

1. Refresh the package lists. This only downloads the list of available versions; it does not install anything:

   apt update

2. If you want, see which packages will be upgraded:

   apt list --upgradeable

3. Install the updates:

   apt upgrade

   The command shows what it will do and asks for confirmation; press Y and Enter. apt upgrade never removes a package: if an update needs a package to be removed, that update is held back.
4. If some packages were held back, you can install them with:

   apt full-upgrade

   full-upgrade may remove packages when that is needed to upgrade the system as a whole. Read the list it shows before you confirm.

If a question comes up about a configuration file you changed earlier (for example SSH or a web server setting), the safe choice when you are not sure is to keep the version currently installed; this is the default answer.

On Ubuntu 22.04 and later, needrestart may show a screen listing services that use updated libraries. On 24.04 those services are restarted automatically; on 22.04 you can choose them in that screen.

Is a reboot needed?

A new kernel only takes effect after a reboot. Check with:

ls /var/run/reboot-required && cat /var/run/reboot-required.pkgs

If the file exists, a reboot is needed; the second file lists the packages that asked for it. On Ubuntu this file is created after updates that need a reboot, such as a kernel update.

needrestart shows whether the running kernel is outdated and which services still use old libraries:

apt install needrestart
needrestart -k
needrestart -r l

-k only checks the kernel; -r l only lists services without restarting them. To reboot the server: reboot. You can also use Restart in the client area.

Installing security updates automatically

On Ubuntu, unattended-upgrades is installed by default and security updates are installed automatically right after setup. If it is missing, you can install it:

apt install unattended-upgrades
dpkg-reconfigure unattended-upgrades

Answer Yes to the question. This creates /etc/apt/apt.conf.d/20auto-upgrades; with these two lines, the lists are refreshed and updates installed every day (0 turns it off):

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

By default only security updates are installed automatically, and the server is not rebooted. If you want an automatic reboot when needed, you can set this in /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

To test the settings: unattended-upgrade -d. What was installed is logged in /var/log/unattended-upgrades/.

Versions that are no longer supported

On Ubuntu 20.04, 18.04 and 16.04 the packages are still on the normal mirrors, so apt update and apt upgrade keep working, but no new security fixes arrive without Ubuntu Pro. If you have an Ubuntu Pro subscription, you can attach the server with your token:

pro attach YOUR_TOKEN
pro status

On LTS releases this turns on the extended security updates (esm-infra and esm-apps) automatically. The lasting solution is to move to a supported release (26.04, 24.04 or 22.04). If you would like your server reinstalled with a current version, you can open a support ticket from your client area.

Troubleshooting

• "Could not get lock /var/lib/dpkg/lock-frontend": another update is running (often the automatic one). Wait a few minutes and try again; do not delete the lock file.
• The update was interrupted: finish it with dpkg --configure -a, then run apt upgrade again.
• The server does not come back after a reboot: open the console in the client area and check the screen (Using the Console on a VDS Server). If you cannot solve it, you can open a support ticket from your client area.

The information in this guide is taken from official documentation: Ubuntu release cycle, Ubuntu Server: Automatic updates, Ubuntu Pro Client, Ubuntu 24.04 release notes, apt(8).