Contents

Introduction

Maintenance is an important part of any system, being it a car, a machine, or a server, and if your server is running Debian Linux or some of its derivatives like Ubuntu you have different tools to keep it working properly.

Maintenance tasks in Linux servers are important, specially because of security risks your system is exposed to when not properly updated and maintained.

The Advanced Package Tool

A package manager is a set of software tools to install, update and upgrade the programs needed by the computer to work. The package manager deals with dependencies and compatibilities to assure proper function of the computer programs installed on a given system.

To achieve that, a good package manager keeps a record of all programs installed, and the dependencies needed by any other program — all of this info is saved in a database. The basic information kept in that database includes:

  • Name
  • Vendor
  • Version
  • Dependencies

In Debian that set of tools is APT which stands for Advanced Package Tool. The basic tool is dpkg; over it you have the better-known set of tools: apt-get, apt-cache and apt. This last one should not be confused with APT, the Advanced Package Tool. Some other tools which are alternatives are: aptitude and, for a graphical interface, Synaptic.

Sources

In order to work, APT and other tools need a list of sources — another server which acts as a repository of all packages that conform a given Debian distribution. You can configure that list of sources at /etc/apt/sources.list. When you invoke APT, it reads that file and downloads the list of packages published by each of those sources (repositories). Behind the scenes, APT will download Packages.gz or Packages.bz2 for binary packages, or Sources.gz / Sources.bz2 for source packages.

APT keeps those files up-to-date by downloading incremental differences in case of any change in the repositories.

The format of the sources.list file is:

deb http://site.example.com/debian distribution component1 component2 component3
deb-src http://site.example.com/debian distribution component1 component2 component3
Element Description
deb / deb-src deb is for binaries, deb-src is for program sources
Repository URL The URL for the repository to look at when searching packages
Distribution A specific name like bookworm or trixie, or a class like stable, testing, unstable
Component main, contrib or non-free

dpkg

dpkg is the main command-line tool for package management. It is usually used when you want to install a .deb package you have already downloaded from the web. It keeps track of all software installed on your system, but it does not know about software available for installation — this means that if a dependency is not already installed, the installation will fail.

You generally want to use apt or aptitude to avoid installation failures. Both apt-get and dpkg have their uses: dpkg is more of a system tool, apt more of a user tool.

Install software with dpkg

Download the .deb file from a trusted source, then run:

dpkg -i htop_2.2.0-2_amd64.deb

Output:

Selecting previously unselected package htop.
(Reading database ... 37412 files and directories currently installed.)
Preparing to unpack htop_2.2.0-2_amd64.deb ...
Unpacking htop (2.2.0-2) ...
Setting up htop (2.2.0-2) ...
Processing triggers for mime-support (3.64) ...
Processing triggers for man-db (2.9.1-1) ...

Check if the program was properly installed

dpkg -l | grep htop

Output:

ii  htop  2.2.0-2  amd64  interactive processes viewer

Remove software with dpkg

dpkg -r htop

This uninstalls the package but leaves its configuration files — useful for easy re-installation. To remove with no traces:

dpkg -P htop

dpkg log file

If something fails, check the log at /var/log/dpkg.log.

apt

Not to be confused with APT, apt is the command-line tool to install, remove and upgrade software on your Debian system. It is an evolution of apt-get and apt-cache, offering the most commonly needed options in a single, simpler command. From man apt:

apt (Advanced Package Tool) is the command-line tool for handling packages.
It provides a commandline interface for the package management of the system.
See also apt-get(8) and apt-cache(8) for more low-level command options.

Install a package

apt install htop

Uninstall a package

apt remove htop

This removes the program but keeps configuration files. To remove everything:

apt purge htop

Keeping your system up to date

For security reasons, always keep your system updated. On Debian Stable, new functionality comes with major upgrades — but security patches are released continuously.

Update source database

apt update

Upgrade installed packages

apt upgrade

Full upgrade to a new release

apt full-upgrade

This upgrades all packages and removes any that would cause conflicts. See the full process in the Upgrading section below.

List all installed packages

apt list --installed

Search for a package

apt search htop

Show package details

apt show htop

Edit sources

apt edit-sources

apt-get, apt-cache

apt-get and apt-cache can perform the same tasks as apt but offer more low-level options. For most users, apt is sufficient. The quick reference:

Task apt apt-get / apt-cache
Install apt install foo apt-get install foo
Remove apt remove foo apt-get remove foo
Update index apt update apt-get update
Upgrade packages apt upgrade apt-get upgrade
Full upgrade apt full-upgrade apt-get dist-upgrade
Search apt search foo apt-cache search foo
Show info apt show foo apt-cache show foo
List by prefix — apt-cache pkgnames alsa

Search all packages starting with a term

apt-cache pkgnames alsa

Output:

alsa-topology-conf
alsa-ucm-conf
alsa-utils
alsa-tools
alsa-plugins
alsa-oss

aptitude

aptitude is a smarter alternative to apt-get. Its main advantage is the ability to offer different options to resolve conflicts during software installation.

Features:

  • A mutt-like syntax for matching packages in a flexible manner
  • Mark packages as "automatically installed" or "manually installed" for auto-removal when no longer required
  • Preview of actions with color coding for different action types
  • Interactive retrieval and display of the Debian changelog for available packages
  • Score-based dependency resolver, more suitable for interactive resolution — allows hints like "keep this part of the solution but not that other part"

Interactive mode

aptitude

Aptitude Interactive

Key bindings:

  • F10 or Ctrl-T — menu
  • ? — help
  • Arrow keys — navigate
  • Enter — select / open and close one level
  • [ / ] — open/close levels recursively
  • + / - — install or remove a package
  • g — preview/confirm actions
  • q — quit / go back

Command line equivalents

Action apt aptitude
Install foo apt install foo aptitude install foo
Search foo apt search foo aptitude search foo
List installed apt list --installed aptitude search ~i
Remove foo apt remove foo aptitude remove foo
Show package info apt show foo aptitude show foo
Download sources apt source foo aptitude source foo

Upgrading Debian to a new release

The current stable release is Debian 12 Bookworm. The process below covers upgrading from Debian 11 Bullseye to Bookworm. The same steps apply to future releases — just replace the codenames accordingly.

Upgrade your current version first

apt update && apt upgrade

Reboot if a new kernel was installed:

reboot

Edit sources

apt edit-sources

Change all occurrences of bullseye to bookworm.

Update repositories

apt update

Upgrade packages

apt upgrade

Follow the prompts. Keep your edited configuration files if you have customized them.

Full upgrade to the new release

apt full-upgrade

Reboot

reboot

Installing packages from Backports

Debian Stable is excellent for its stability, but software gets outdated over time. When you need a newer version of a package not available in Stable, backports are the solution. According to the backports site:

Backports are packages taken from the next Debian release (called "testing"), adjusted and recompiled for usage on Debian stable. Because the package is also present in the next Debian release, you can easily upgrade your stable+backports system once the next Debian release comes out.

Add Backports to your sources

apt edit-sources

Add this line:

deb http://deb.debian.org/debian bookworm-backports main

Update the repositories

apt update

Install software from backports

apt-get -t bookworm-backports install htop

Keeping your system clean

Linux is intended to live for a long time on your machine, and when something lives that long, garbage accumulates. To keep everything clean, you can use autoremove and clean.

apt autoremove removes packages that were installed as dependencies but are no longer needed by anything:

apt autoremove

apt clean clears the local cache of downloaded package files — they are no longer needed once installed:

apt clean

If you want to remove only packages that can no longer be downloaded, leaving the rest of the cache intact:

apt autoclean

Running autoremove and clean occasionally is good housekeeping, specially on servers where disk space matters.

Checking upgradable packages

Before upgrading blindly you may want to check the packages flagged for upgrade. One command gives you the full list:

apt list --upgradable

That way you know exactly what is going to change on your system before committing to it — useful when you want to review a long list of updates or check whether a specific package is among them.

Holding packages back

When you are working with apps you may want to keep a specific version of a package. It was my case with Ruby when using Middleman — if you are managing this with Debian package tools, you have hold and unhold to flag a package so it does not get upgraded.

apt-mark hold ruby

To see which packages are currently on hold:

apt-mark showhold

When you are ready to let it upgrade again:

apt-mark unhold ruby

Automatic security updates

Security is more and more important every day. You really want to keep your system with security upgrades even if you are not working or checking the server every day. The unattended-upgrades package takes care of that automatically.

apt install unattended-upgrades
dpkg-reconfigure -pmedium unattended-upgrades

The second command opens an interactive prompt — answer yes to enable automatic updates. By default it applies only security updates, leaving you in control of everything else.

Third-party repositories

Lots of apps are developed for Debian or Ubuntu, and most of them have their own repositories. Here is how to manage them.

The modern way uses a dedicated keyring file and a signed-by reference in the source entry — more secure than the deprecated apt-key approach. For example, adding the official Docker repository:

# Download and store the signing key
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Add the repository
echo \
  "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian bookworm stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list

# Update and install
apt update
apt install docker-ce

Each third-party repository will give you its own instructions, but the pattern is always the same: store the key in /etc/apt/keyrings/, add a .list file in /etc/apt/sources.list.d/, and reference the key with signed-by=.

Organizing your sources

Investing time today in keeping your system organized is time you will enjoy in the future. Instead of adding everything to /etc/apt/sources.list, keep that file clean by placing each additional source in its own file inside /etc/apt/sources.list.d/:

ls /etc/apt/sources.list.d/

Each file there follows the same format as sources.list. Keeping them separate means you can disable or remove a repository by simply deleting or renaming its file — no need to touch sources.list at all.

# Disable a repo without deleting it
mv /etc/apt/sources.list.d/docker.list /etc/apt/sources.list.d/docker.list.disabled

# Re-enable it
mv /etc/apt/sources.list.d/docker.list.disabled /etc/apt/sources.list.d/docker.list

References

Contribute

If you want to contribute you can do it at GitHub