Update Ubuntu and Debian server packages safely
By the end: You will have reviewed the proposed changes, applied suitable updates and checked access and applications. A package is installed software or one of its components.
Current packages help address known vulnerabilities and software defects. However, updating a web server, database or SSH package can affect running services. This guide covers controlled package updates within the current operating system release.
Applies to: Ubuntu 24.04 LTS and Debian 13 using APT, with a sudo-enabled account. It does not cover distribution release upgrades, changing the selected kernel family, or updating components managed by a control panel such as cPanel. If you use a control panel, first follow its vendor's supported update procedure.
Check each result before moving to the next step.
- Backup and maintenance
Prepare recovery, disk space, a maintenance time and recovery access.
- Review the plan
Refresh package information; preview changes with apt -s upgrade.
- Apply the update
If the plan is suitable, run apt upgrade and read confirmation and configuration prompts.
- Check again
Test a new SSH connection, services and the application's essential operations.
Package updates can restart services; choose a suitable maintenance window in advance.
1. Prepare maintenance and recovery
Complete four preparations before starting:
- Prepare a current backup you can restore.
- Confirm there is enough disk space.
- Choose a maintenance time suitable for affected customers.
- Verify a second SSH connection and a recovery method.
Not ready? Complete the missing preparation before running the update.
Check your application's supported versions and any third-party package repositories. Prepare a current backup and a tested restore path. Use the resource checks to confirm sufficient disk space. Choose a maintenance window because services may restart during updates.
Keep your SSH session open and verify a second connection. Before a possible reboot, establish the console or recovery method actually available for your service. If you do not have working recovery access, plan changes that affect connectivity with your administrator or support.
2. Refresh package information and review changes
Where? On the server, through SSH. Run each line in order. If one fails, resolve it before the next line.
| Command | What it does | Expected result |
|---|---|---|
sudo apt update | Refreshes repository package information | Lists download without errors; software is not yet upgraded |
apt list --upgradable | Lists available package updates | Package/version list, or no packages to upgrade |
sudo apt -s upgrade | Previews the update without applying it | Summary of proposed changes |
sudo requests administrator privileges; -s means simulation. A repository is a source from which packages are downloaded.
Run these commands on the server. The first refreshes package information without yet upgrading installed software:
sudo apt update
apt list --upgradable
sudo apt -s upgrade
apt -s upgrade simulates the operation. Review new packages, components to be updated and the proposed changes. Resolve repository, signature or network errors from apt update before proceeding; do not disable signature verification.
Simulation does not test application compatibility. In particular, compare third-party database and runtime packages with your application's support requirements. For critical production systems, test in a comparable non-production environment first.
3. Run the update interactively
Similar names do not mean the same operation.
- apt update
Refreshes package information. It does not upgrade installed software.
- apt upgrade
Upgrades eligible installed packages. Read the proposed change summary.
- apt autoremove
Removes dependencies considered unnecessary. It does not apply held-back updates.
full-upgrade may remove packages; neither it nor autoremove is an automatic next step.
This step changes software on the server. Run it only after preparing the backup and reviewing the plan. Read the confirmation summary; stop before agreeing if changes are unexpected.
If preparation and the simulation are satisfactory:
sudo apt upgrade
Compare the confirmation summary with the changes you expect. Leaving out -y allows you to review package manager prompts. If asked to replace a configuration file, inspect the differences between your settings and the new version instead of blindly replacing everything.
apt upgrade can hold back an update if it requires removing installed packages. Do not immediately run full-upgrade for remaining updates; review its new plan, including removals, separately. autoremove removes dependencies considered no longer required; it does not upgrade held-back packages. Review its removal list separately too. An operating system release upgrade needs its own migration plan.
4. Check the result and running services
Check on the server. Run these commands in order, then test the application too.
| Check | What should you see? |
|---|---|
apt list --upgradable | Remaining updates; investigate why any remain |
systemctl --failed --no-pager | Failed units; investigate any reported errors |
uname -r | The kernel version currently running |
The kernel is the operating system's core. Installing a new kernel package does not mean that version is already running.
apt list --upgradable
systemctl --failed --no-pager
uname -r
Confirm that the package operation completed without errors. Investigate remaining updates: phased delivery, held packages or dependencies may be involved. Even if systemctl --failed lists nothing, test the web service, database and application flows. Open a fresh SSH connection; a surviving old session does not prove that new connections work.
On Ubuntu, /var/run/reboot-required may indicate that a reboot is needed. Its absence is not definitive on every system. Follow package notifications and distribution guidance. If a reboot is required, wait until the maintenance window, package operations are complete and recovery is ready. Afterwards, verify the running kernel, SSH access and application again.
After completion:
- Open a new SSH connection from a separate window on your computer.
- Check the website and the application's essential operation.
- Verify the relevant database and services.
- Record the result and time.
Common errors and recovery
An APT lock error may mean another package operation or automatic update is running. Do not delete lock files or arbitrarily kill package manager processes; identify the active operation and allow it to finish. If disk space runs out, perform the disk checks instead of deleting large files at random.
There is no single general-purpose command that safely undoes every failed update. Inspect package logs, service errors and the current data state, then follow your application or system restore plan. Before reverting to an earlier copy, decide how to preserve records created since that copy.
Automatic update behavior depends on the image and configuration. Do not assume it is enabled. Check allowed repositories, notifications and reboot policy separately.