Run Updates¶
With the sources right, updating is two commands (CIS 1.2.2.1). Do it early in the round so the reboot, if one is needed, happens while you still have time.
Update everything¶
sudo apt update
sudo apt upgrade -y
sudo apt full-upgrade -y
update refreshes the package lists. upgrade installs newer versions of what's installed. full-upgrade does the same but is allowed to remove a package if a new dependency requires it, which is how kernel updates sometimes arrive. Watch the output for "The following packages have been kept back"; those need full-upgrade.
The kernel¶
uname -r
apt list --installed 'linux-image-*' 2>/dev/null
If apt installed a newer linux-image than uname -r shows, the update is on disk but not running. Reboot when it's convenient; until then the old kernel, with its known bugs, is what's loaded. /var/run/reboot-required exists when a reboot is needed.
A specific package¶
The README may call out software that must be updated, or you may find an old version of something the machine serves (an Apache, a PHP, an OpenSSH):
apt policy openssh-server
sudo apt install --only-upgrade openssh-server
apt policy shows the installed version and the candidate; if they differ, an update is waiting.
Nothing left¶
apt list --upgradable 2>/dev/null
Empty output means every installed package is at the latest version the sources offer.
Verify¶
apt list --upgradable 2>/dev/null | wc -l # 1 (the header line only)
uname -r
ls /var/run/reboot-required 2>/dev/null
Example¶
apt list --upgradable lists 214 packages including openssh-server, linux-image-generic, and firefox. apt upgrade -y gets most; full-upgrade -y installs the new kernel. uname -r still shows the old one; /var/run/reboot-required exists. Snapshot, reboot, uname -r shows the new kernel.
Try it¶
- Run
apt list --upgradable, count them,apt upgrade, count again. - Check
uname -ragainst the newest installedlinux-imagepackage.
Build it¶
Add apt list --upgradable | wc -l, uname -r, and the reboot-required check to baseline.sh.