Packages and updates
🏠The everyday picture
A phone that never installs updates works fine until someone uses a known weakness to break in. Most attacks use holes that were fixed months ago, on systems that weren't updated.
📘What it really is
- Ubuntu installs software with apt:
sudo apt update: refresh the list of available versions;sudo apt upgrade: install updates;sudo apt install nginx: install software;sudo apt remove name,sudo apt autoremove;-
apt list --upgradable. -
Security updates are urgent. Turn on unattended-upgrades so security fixes install automatically:
sudo apt install unattended-upgradesthensudo dpkg-reconfigure unattended-upgrades. -
Some updates (the kernel) need a reboot to take effect;
/var/run/reboot-requiredexists when one's needed. Plan reboots at quiet times. -
Install software from trusted sources: the distribution's own packages, or a vendor's official repository (like Node.js's NodeSource or PostgreSQL's apt repository). Be wary of random install scripts piped into
sudo bash. -
Keep the server minimal: every installed program and open port is something to update and something to attack. Remove what you don't use.
-
Application dependencies (npm packages) need updating too (Module 41's
npm audit, Dependabot).
🖱️Try it
In your lab: sudo apt update, apt list --upgradable, sudo apt upgrade. Install and enable unattended-upgrades. Check
whether a reboot is required. Install Node.js LTS from its official source.
✅Quick check
Why turn on automatic security updates?
Show the answer
Most attacks use known, already-fixed weaknesses; automatic updates close them quickly.
Why keep a server minimal?
Show the answer
Fewer programs and open ports mean less to update and fewer ways in.