Debian and Ubuntu: The Complete Administration Guide

Debian and Ubuntu make up the most widely used family of Linux distributions in the world, on servers and desktops alike. If you are just starting out in system administration, chances are your first Linux machine runs one of these two distributions. In this guide, we will cover everything you need to administer a Debian or Ubuntu system day to day: package management with APT, repository configuration, release upgrades, and troubleshooting the most common problems.

1. Debian and Ubuntu: What Are the Differences?

Ubuntu is built on top of Debian: roughly 90% of Ubuntu packages come directly from the Debian repositories. The two distributions therefore share the same package format (.deb), the same APT package manager, and much of their documentation. They do differ on several important points, however.

Criterion	Debian	Ubuntu
Publisher	Community project	Canonical (company)
Release cycle	About every 2 years, “when it’s ready”	Every 6 months, fixed dates
LTS versions	Every stable release (~5 years with LTS)	One LTS every 2 years (5 years of support)
Stability	Very conservative, battle-tested packages	Newer packages
Proprietary software	Kept separate (non-free)	Integrated more easily
Snap	Not present by default	Installed and used by default
Target audience	Servers, free software purists	Beginners, desktops, cloud

In short: Debian prioritizes stability and software freedom, while Ubuntu prioritizes ease of use and up-to-date packages. For a production server, both are excellent choices.

2. Understanding the Release Cycle and LTS Versions

Ubuntu releases

Ubuntu publishes a release every six months, numbered by the year and month of release: 24.04 means April 2024. Every two years, the April release is an LTS (Long Term Support) release supported for five years. Interim releases are supported for only nine months.

# Afficher la version installée
lsb_release -a

# Alternative sans lsb_release
cat /etc/os-release

A simple rule: on a server, always install an LTS (20.04, 22.04, 24.04…). Interim releases are reserved for users’ desktops who want the latest features.

Debian releases

Debian maintains three branches in parallel:

• stable: the production release, updated only for security;
• testing: the future stable release, currently being prepared;
• unstable (sid): the development branch, where new packages arrive.

Each stable release carries a codename taken from Toy Story characters (Bookworm, Trixie…). A stable release is supported for about three years by the security team, then for two more years by the LTS project.

3. APT in Depth

APT (Advanced Package Tool) is the central tool for package management. Here are the commands you will use every day.

Updating the package list

# Télécharge les index des dépôts (ne modifie rien sur le système)
sudo apt update

This command does not upgrade anything: it simply refreshes the list of available packages. Always run it before an installation or an upgrade.

Upgrading installed packages

# Met à jour les paquets sans en supprimer ni en installer de nouveaux
sudo apt upgrade

# Met à jour en autorisant l'installation ou la suppression de paquets
# (nécessaire pour les mises à jour du noyau, par exemple)
sudo apt full-upgrade

The difference is important: upgrade refuses any update that would require removing a package, whereas full-upgrade (formerly dist-upgrade) agrees to resolve dependency changes. On a server, get into the habit of carefully reading what full-upgrade proposes before confirming.

Installing and removing packages

# Installer un paquet
sudo apt install nginx

# Installer plusieurs paquets d'un coup
sudo apt install curl git htop

# Supprimer un paquet en gardant ses fichiers de configuration
sudo apt remove nginx

# Supprimer un paquet ET ses fichiers de configuration
sudo apt purge nginx

# Supprimer les dépendances devenues inutiles
sudo apt autoremove

Run apt autoremove regularly: when you remove a package, its dependencies stay installed and pile up over time.

Searching and inspecting packages

# Rechercher un paquet par mot-clé
apt search "serveur web"

# Afficher les détails d'un paquet (version, taille, dépendances, description)
apt show nginx

# Lister les versions disponibles et leur provenance
apt-cache policy nginx

# Lister les dépendances d'un paquet
apt-cache depends nginx

# Lister les paquets qui dépendent d'un paquet
apt-cache rdepends nginx

Pinning: freezing or prioritizing versions

Pinning lets you control which version of a package APT should prefer, for example to prevent an upgrade or to pull a package from a specific repository.

# Empêcher toute mise à jour d'un paquet (méthode simple)
sudo apt-mark hold nginx

# Réautoriser les mises à jour
sudo apt-mark unhold nginx

# Lister les paquets gelés
apt-mark showhold

For finer control, create a file in /etc/apt/preferences.d/:

# /etc/apt/preferences.d/nginx-pin
# Priorité > 1000 : force cette version même s'il faut rétrograder
Package: nginx
Pin: version 1.24.*
Pin-Priority: 1001

4. sources.list and Repositories

Where repositories are defined

APT repositories are declared in /etc/apt/sources.list and in the files in the /etc/apt/sources.list.d/ directory. On recent releases (Debian 12+, Ubuntu 24.04+), the “deb822” format in .sources files is gradually replacing the old format.

# Ancien format (une ligne par dépôt)
# type  URL  distribution  composants
deb http://deb.debian.org/debian bookworm main contrib non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main

The components have precise meanings:

• main: officially supported free software;
• contrib (Debian): free software that depends on non-free software;
• non-free / non-free-firmware (Debian): proprietary software and firmware;
• universe / multiverse (Ubuntu): community-maintained and non-free packages.

Modifying repositories safely

# Ne modifiez jamais sources.list à la main sans sauvegarde
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak

# Ajoutez plutôt vos dépôts tiers dans des fichiers séparés
sudo nano /etc/apt/sources.list.d/mon-depot.list

# Après toute modification, rafraîchissez les index
sudo apt update

Modern third-party repositories require a signing key stored in /etc/apt/keyrings/ and referenced with the signed-by option:

# Exemple : ajout du dépôt officiel Docker
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

echo "deb [signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu noble stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list

5. PPAs on Ubuntu

PPAs (Personal Package Archives) are personal repositories hosted on Launchpad, specific to the Ubuntu ecosystem. They let you get newer versions of software than those in the official repositories.

# Ajouter un PPA (ajoute le dépôt et sa clé automatiquement)
sudo add-apt-repository ppa:ondrej/php
sudo apt update

# Supprimer un PPA
sudo add-apt-repository --remove ppa:ondrej/php

# Supprimer un PPA et rétrograder les paquets vers les versions officielles
sudo apt install ppa-purge
sudo ppa-purge ppa:ondrej/php

Warning: a PPA is maintained by a third-party individual or team. Only add PPAs from reputable sources, and avoid them on production servers when an official alternative exists.

6. dpkg: The Low Level

APT relies on dpkg, the low-level tool that actually installs .deb files. You will need it in certain specific situations.

# Installer un fichier .deb téléchargé manuellement
sudo dpkg -i paquet.deb

# Si dpkg signale des dépendances manquantes, laissez APT les résoudre
sudo apt install -f

# Méthode moderne recommandée : apt gère le .deb ET ses dépendances
sudo apt install ./paquet.deb

# Lister tous les paquets installés
dpkg -l

# Vérifier si un paquet est installé
dpkg -l | grep nginx

# Lister les fichiers installés par un paquet
dpkg -L nginx

# Trouver à quel paquet appartient un fichier
dpkg -S /etc/nginx/nginx.conf

7. Release Upgrades

Ubuntu: do-release-upgrade

Ubuntu provides a dedicated tool for moving from one release to the next:

# 1. Mettre le système entièrement à jour avant tout
sudo apt update && sudo apt full-upgrade
sudo reboot

# 2. Lancer la mise à niveau
sudo do-release-upgrade

# Vérifier le comportement configuré (lts ou normal)
cat /etc/update-manager/release-upgrades

With Prompt=lts in this file, the tool only offers LTS-to-LTS upgrades (22.04 to 24.04, for example), which is the recommended setting on a server. Note that upgrading from one LTS to the next is only offered after the first point release is out (24.04.1, for example).

Debian: modifying the sources

On Debian, the upgrade is done by changing the codename in the sources and then running a full upgrade:

# 1. Sauvegarder et remplacer le nom de code (ex. bookworm -> trixie)
sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list

# 2. Mise à niveau en deux temps, comme le recommandent les notes de version
sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade
sudo reboot

In every case: make a full backup before upgrading, read the release notes, and never skip a release (going directly from Debian 11 to 13 is not supported).

8. Automatic Updates with unattended-upgrades

On a server, automatically applying security patches is an almost essential best practice.

# Installation et activation
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

The configuration is located in /etc/apt/apt.conf.d/50unattended-upgrades:

// Extrait de configuration typique
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
// Redémarrage automatique si nécessaire (ex. mise à jour du noyau)
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

# Tester la configuration sans rien appliquer
sudo unattended-upgrade --dry-run --debug

# Consulter les journaux
less /var/log/unattended-upgrades/unattended-upgrades.log

9. Snap vs APT

Ubuntu promotes the Snap format, self-contained packages that bundle their own dependencies. The topic is divisive, and it is useful to understand the trade-offs.

Criterion	APT (.deb)	Snap
Dependencies	Shared between packages	Bundled in each snap
Disk footprint	Small	Large (duplicated libraries)
Version freshness	Frozen for the lifetime of the release	Always the latest version
Updates	Controlled by the administrator	Automatic (hard to block)
Application startup	Fast	Slower (squashfs mounting)
Security isolation	None by default	Sandbox confinement
Availability	All .deb distributions	Mainly Ubuntu

# Commandes snap de base
snap list                      # snaps installés
sudo snap install code --classic
sudo snap refresh              # mettre à jour
sudo snap remove code

In practice: on a server, prefer APT for anything available as a .deb. Snaps remain relevant for recent desktop applications or tools that the vendor only distributes this way.

10. Common Troubleshooting

dpkg lock: “Could not get lock”

This message appears when another process is already using APT (often an automatic background update):

# Identifier le processus qui tient le verrou
sudo lsof /var/lib/dpkg/lock-frontend

# Attendre qu'il se termine, ou vérifier les processus apt en cours
ps aux | grep -E "apt|dpkg"

Only delete the lock file manually as a last resort, after verifying that no apt or dpkg process is running: removing the lock during an installation in progress can corrupt the package database.

# En dernier recours seulement, si aucun processus n'est actif
sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock
sudo dpkg --configure -a

Broken dependencies

# Tenter la réparation automatique
sudo apt install -f

# Terminer la configuration des paquets interrompus
sudo dpkg --configure -a

# Nettoyer le cache et retélécharger les index
sudo apt clean
sudo apt update

# Réinstaller un paquet endommagé
sudo apt install --reinstall nom-du-paquet

Disk space filled by the APT cache

# Voir la taille du cache
du -sh /var/cache/apt/archives

# Supprimer les .deb des versions obsolètes uniquement
sudo apt autoclean

# Vider entièrement le cache
sudo apt clean

Best Practices

• On servers, install only LTS (Ubuntu) or stable (Debian) releases.
• Run sudo apt update before any installation or upgrade.
• Read the list of changes proposed by full-upgrade before confirming.
• Enable unattended-upgrades for security patches.
• Add third-party repositories in /etc/apt/sources.list.d/ with a signed-by key, never in the main file.
• Limit PPAs to the strict minimum and avoid them in production.
• Make a full backup before every release upgrade.
• Clean up regularly with apt autoremove and apt autoclean.

Conclusion

Debian and Ubuntu offer one of the most mature package management ecosystems in the Linux world. By mastering APT, the repository structure, the upgrade mechanisms, and the few troubleshooting reflexes presented here, you have everything you need to administer these systems with confidence day to day. The logical next steps in your learning: service management with systemd, firewall configuration with ufw, and automating your deployments. Practice on a virtual machine, break things, fix them: that is how you make progress.