Update your server's packages

A fresh server ships with software that may already have security fixes waiting. Ubuntu manages software with apt, its package manager, so keeping your server current is a short routine you can repeat whenever you log in.

Before you begin

• A sudo-enabled user you can log in with over SSH.
• About 10 to 20 minutes, depending on how many updates are waiting.
• If you use Afterglow snapshots, take one before major upgrades so you can roll back if something breaks.

Step 1: Refresh the package list

sudo apt update downloads the latest list of available packages and versions from Ubuntu's servers. It does not install anything yet. The sudo prefix runs the command with administrative rights:

sudo apt update

Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Get:2 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Fetched 1,840 kB in 2s (900 kB/s)
Reading package lists... Done
Building dependency tree... Done
47 packages can be upgraded. Run 'apt list --upgradable' to see them.

Step 2: See what will change

Before installing, you can list the packages that have newer versions available:

apt list --upgradable

Each line shows the package name, the new version and the currently installed version. If you see something unfamiliar, you can search for it later, but most entries are routine security and bug fixes.

Step 3: Install the updates

sudo apt upgrade -y installs the newer versions of everything listed. The -y flag answers "yes" to the confirmation prompt, which saves time on a server you are watching anyway:

sudo apt upgrade -y

During the upgrade you may see a screen asking which services to restart. The default choices are safe, so press Enter to accept them.

Step 4: Remove leftovers

Old dependencies that nothing needs anymore can be removed to free disk space. The clean command deletes downloaded package files from the cache:

sudo apt autoremove -y
sudo apt clean

Step 5: Check whether a reboot is needed

Some updates, especially to the kernel or core libraries, only take effect after a restart. Ubuntu writes a marker file when a reboot is required. Check for it:

cat /var/run/reboot-required

If the file exists, you see a message such as *** System restart required ***. If it does not exist, you see "No such file or directory", which means no reboot is needed right now.

Step 6: Reboot safely

When a reboot is needed, run sudo reboot. Your SSH connection closes. Wait a minute or two, then connect again:

sudo reboot

ssh alex@203.0.113.10

Step 7: Keep security updates automatic

Ubuntu server images usually include unattended-upgrades, which installs security updates automatically. Confirm that it is active:

systemctl status unattended-upgrades --no-pager

The --no-pager flag prints the status straight to the screen. Look for active (running). If it is missing, install it with sudo apt install -y unattended-upgrades.

Troubleshooting

• "Could not get lock /var/lib/dpkg/lock-frontend." Another package process is running, often the automatic updater right after first boot. Wait a few minutes and try again. You can check with ps aux | grep -i apt.
• "Failed to fetch" or "Temporary failure resolving". The server cannot reach Ubuntu's mirrors. Run sudo apt update again, and if it fails repeatedly, check the server's network connection with ping -c 3 archive.ubuntu.com.
• The disk is full during upgrade. Check space with df -h /, then run sudo apt clean to free the package cache.
• A service stopped working after an update. Check its status with systemctl status servicename and read the recent log lines it prints.

Next steps

Your server is current. Next, set up a firewall so that only the ports you actually use are open to the internet.