Apticron runs nightly on the box and is telling me that I have about 150 updates that need to be made. The server is running quite a few important services with no true backup so I'm scared to just start updating. How should I game plan this?

Edit: lsb_release:
Distributor ID: Ubuntu
Description: Ubuntu 8.04.3 LTS
Release: 8.04
Codename: hardy

The following packages are currently pending an upgrade:

apache2 2.2.8-1ubuntu0.25
apache2.2-common 2.2.8-1ubuntu0.25
apache2-mpm-prefork 2.2.8-1ubuntu0.25
apache2-utils 2.2.8-1ubuntu0.25
apparmor 2.1+1075-0ubuntu9.3
apparmor-utils 2.1+1075-0ubuntu9.3
apt 0.7.9ubuntu17.6
apt-utils 0.7.9ubuntu17.6
base-files 4.0.1ubuntu5.8.04.8
bind9-host 1:9.4.2.dfsg.P2-2ubuntu0.12
bsdutils 1:2.13.1-5ubuntu3.1
bzip2 1.0.4-2ubuntu4.2
clamav 0.97.8+dfsg-1ubuntu1.08.04.1
clamav-base 0.97.8+dfsg-1ubuntu1.08.04.1
clamav-freshclam 0.97.8+dfsg-1ubuntu1.08.04.1
curl 7.18.0-1ubuntu2.4
dhcp3-common 3.0.6.dfsg-1ubuntu9.3
dnsutils 1:9.4.2.dfsg.P2-2ubuntu0.12
fuse-utils 2.7.2-1ubuntu2.3
gnupg 1.4.6-2ubuntu5.2
gpgv 1.4.6-2ubuntu5.2
grub 0.97-29ubuntu21.2
gzip 1.3.12-3.2ubuntu0.1
klibc-utils 1.5.7-4ubuntu5
krb5-user 1.6.dfsg.3~beta1-2ubuntu1.8
ldap-utils 2.4.9-0ubuntu0.8.04.5
libapache2-mod-fcgid 1:2.2-1ubuntu0.8.04.1
libapache2-mod-php5 5.2.4-2ubuntu5.27
libapache2-svn 1.5.1dfsg1-1ubuntu2~hardy3
libapr1 1.2.11-1ubuntu0.2
libaprutil1 1.2.12+dfsg-3ubuntu0.3
libbind9-30 1:9.4.2.dfsg.P2-2ubuntu0.12
libbz2-1.0 1.0.4-2ubuntu4.2
libc6 2.7-10ubuntu8.3
libc6-dev 2.7-10ubuntu8.3
libc6-i686 2.7-10ubuntu8.3
libclamav6 0.97.8+dfsg-1ubuntu1.08.04.1
libcupsys2 1.3.7-1ubuntu3.16
libcurl3 7.18.0-1ubuntu2.4
libcurl3-gnutls 7.18.0-1ubuntu2.4
libdbus-1-3 1.1.20-1ubuntu3.9
libdns35 1:9.4.2.dfsg.P2-2ubuntu0.12
libdns36 1:9.4.2.dfsg.P2-2ubuntu0.12
libexpat1 2.0.1-0ubuntu1.2
libexpat1-dev 2.0.1-0ubuntu1.2
libfreetype6 2.3.5-1ubuntu4.8.04.10
libfreetype6-dev 2.3.5-1ubuntu4.8.04.10
libfuse2 2.7.2-1ubuntu2.3
libgc1c2 1:6.8-1.1ubuntu0.1
libgd2-xpm 2.0.35.dfsg-3ubuntu2.1
libgd2-xpm-dev 2.0.35.dfsg-3ubuntu2.1
libgnutls13 2.0.4-1ubuntu2.9
libhtml-parser-perl 3.56-1ubuntu0.1
libisc35 1:9.4.2.dfsg.P2-2ubuntu0.12
libisccc30 1:9.4.2.dfsg.P2-2ubuntu0.12
libisccfg30 1:9.4.2.dfsg.P2-2ubuntu0.12
libkadm55 1.6.dfsg.3~beta1-2ubuntu1.8
libklibc 1.5.7-4ubuntu5
libkrb53 1.6.dfsg.3~beta1-2ubuntu1.8
libkrb5-dev 1.6.dfsg.3~beta1-2ubuntu1.8
liblcms1 1.16-7ubuntu1.3
libldap-2.4-2 2.4.9-0ubuntu0.8.04.5
liblwres30 1:9.4.2.dfsg.P2-2ubuntu0.12
libmysqlclient15off 5.0.96-0ubuntu3
libpango1.0-0 1.20.5-0ubuntu1.2
libpango1.0-common 1.20.5-0ubuntu1.2
libperl5.8 5.8.8-12ubuntu0.8
libpng12-0 1.2.15~beta5-3ubuntu0.7
libpng12-dev 1.2.15~beta5-3ubuntu0.7
libpq5 8.3.23-0ubuntu8.04.1
libsnmp15 5.4.1~dfsg-4ubuntu4.4
libsnmp-base 5.4.1~dfsg-4ubuntu4.4
libssl0.9.8 0.9.8g-4ubuntu3.20
libssl-dev 0.9.8g-4ubuntu3.20
libsvn1 1.5.1dfsg1-1ubuntu2~hardy3
libsvn-perl 1.5.1dfsg1-1ubuntu2~hardy3
libtasn1-3 1.1-1ubuntu0.1
libthai0 0.1.9-1ubuntu0.2
libthai-data 0.1.9-1ubuntu0.2
libtiff4 3.8.2-7ubuntu3.16
libtomcat5.5-java 5.5.25-5ubuntu1.3
libwww-perl 5.808-1ubuntu0.1
libxml2 2.6.31.dfsg-2ubuntu1.12
libxml2-dev 2.6.31.dfsg-2ubuntu1.12
libxslt1.1 1.1.22-1ubuntu1.4
libxslt1-dev 1.1.22-1ubuntu1.4
linux-image-2.6.24-32-server 2.6.24-32.107
linux-libc-dev 2.6.24-32.107
linux-ubuntu-modules-2.6.24-32-server 2.6.24-32.52
logrotate 3.7.1-3ubuntu0.8.04.1
mount 2.13.1-5ubuntu3.1
mysql-client-5.0 5.0.96-0ubuntu3
mysql-common 5.0.96-0ubuntu3
mysql-server 5.0.96-0ubuntu3
mysql-server-5.0 5.0.96-0ubuntu3
nagios-plugins 1.4.11-1ubuntu5.1
nagios-plugins-basic 1.4.11-1ubuntu5.1
nagios-plugins-extra 1.4.11-1ubuntu5.1
nagios-plugins-standard 1.4.11-1ubuntu5.1
nfs-common 1:1.1.2-2ubuntu2.4
nscd 2.7-10ubuntu8.3
ntp 1:4.2.4p4+dfsg-3ubuntu2.3
ntpdate 1:4.2.4p4+dfsg-3ubuntu2.3
openssh-client 1:4.7p1-8ubuntu3
openssh-server 1:4.7p1-8ubuntu3
openssl 0.9.8g-4ubuntu3.20
perl 5.8.8-12ubuntu0.8
perl-base 5.8.8-12ubuntu0.8
perl-doc 5.8.8-12ubuntu0.8
perl-modules 5.8.8-12ubuntu0.8
php5 5.2.4-2ubuntu5.27
php5-cli 5.2.4-2ubuntu5.27
php5-common 5.2.4-2ubuntu5.27
php5-curl 5.2.4-2ubuntu5.27
php5-dev 5.2.4-2ubuntu5.27
php5-gd 5.2.4-2ubuntu5.27
php5-ldap 5.2.4-2ubuntu5.27
php5-mysql 5.2.4-2ubuntu5.27
php5-sybase 5.2.4-2ubuntu5.27
php5-tidy 5.2.4-2ubuntu5.27
phpmyadmin 4:2.11.3-1ubuntu1.3
postfix 2.5.1-2ubuntu1.4
python2.5 2.5.2-2ubuntu6.2
python2.5-dev 2.5.2-2ubuntu6.2
python2.5-minimal 2.5.2-2ubuntu6.2
python-apt 0.7.4ubuntu7.7
python-libxml2 2.6.31.dfsg-2ubuntu1.12
python-subversion 1.5.1dfsg1-1ubuntu2~hardy3
samba-doc 3.0.28a-1ubuntu4.18
snmp 5.4.1~dfsg-4ubuntu4.4
ssh 1:4.7p1-8ubuntu3
subversion 1.5.1dfsg1-1ubuntu2~hardy3
subversion-tools 1.5.1dfsg1-1ubuntu2~hardy3
sudo 1.6.9p10-1ubuntu3.10
sun-java5-bin 1.5.0-22-0ubuntu0.8.04
sun-java5-demo 1.5.0-22-0ubuntu0.8.04
sun-java5-jdk 1.5.0-22-0ubuntu0.8.04
sun-java5-jre 1.5.0-22-0ubuntu0.8.04
tomcat5.5 5.5.25-5ubuntu1.3
tomcat5.5-admin 5.5.25-5ubuntu1.3
tomcat5.5-webapps 5.5.25-5ubuntu1.3
tzdata 2012e~repack-0ubuntu0.8.04
update-manager-core 1:0.87.33
util-linux 2.13.1-5ubuntu3.1
util-linux-locales 2.13.1-5ubuntu3.1
w3m 0.5.1-5.1ubuntu1.1
wget 1.10.2-3ubuntu1.2
x11-xserver-utils 7.3+2ubuntu0.1
  • 1
    what version of Ubuntu is it running? – Tarun Aug 27 '13 at 13:07
  • Description: Ubuntu 8.04.3 LTS – jon_brockman Aug 27 '13 at 13:17
  • 8
    Do you really expect an answer where you will not be told to make a backup? :-) – Andrea Corbellini Aug 27 '13 at 13:18
  • I believe you need an answer more on management level here. Without backups and no information about the services and data, there's not really a specific answer to provide other than "you should be able to upgrade from LTS (8.04) to LTS (10.04) to LTS (12.04)". And yeah, just fix the backups part. Personally, I would prefer a fresh install, copied the data onto the new installation. – gertvdijk Aug 27 '13 at 13:24
  • 1
    Andrea: I did of course expect that making a backup would be part of every response. That, however, is the easy part. – jon_brockman Aug 27 '13 at 13:49

Based on the versions of those packages, this appears to be Ubuntu Hardy 8.04 LTS. That's over five years old. Despite its age, official support only ended in May 2013 but it's never going to get security updates any longer and that's a problem.

The versions listed above were published in 2010 and that should highlight the urgency of the task at hand. This server is probably vulnerable to multiple remote exploits.

You could attempt in-place distribution upgrades to 12.04 (which is supported until 2017) but this means service interruption immediately and could mean things break. It could also take a couple of iterations to get to 12.04. It's just a messy idea.

I'd start afresh. New server, new Ubuntu install.

  1. Make a backup just in case it does just explode but otherwise leave the old server as it is. Whoever is currently using this server will not appreciate any downtime so leaving the old one up is your route to happy co-workers and a happy boss.

  2. Install Ubuntu 12.04 (or whatever the latest LTS is at the time of reading) on a new server (or virtual machine, however you've got things set up). If this is one of many servers at the company, it might be worth looking at hardware consolidation/redundancy techniques that virtualisation works well with.

  3. Build a list of things you need to get working from the old server. What websites are there running on it? What services do people depend on it providing? What IPs does it use? Can the IP be changed? How? Where? Who will that disrupt?

    By the end of this stage you should have a document telling you what you need to do.

  4. Install the packages from #3 but don't simply copy forward old configuration.

    It's really tempting to port /etc/ over from the old server but I've done similar things with PHP before and it set me back days. Use your observations from #3 and from playing around with the old server to build new a new configuration based on modern best practices.

  5. Copy your websites and databases over.

  6. Test and fix. I've no idea how long this will take because I've never upgraded a Tomcat website before but at the very least you need to make sure it still does everything it's supposed to.

  7. When you're happy it works, you'll need to copy over the data again from the old server (assuming people have been using it in the meantime).

  8. Unplug the old server and toss it into the sea. Or repurpose it. It's probably ancient and inefficient so it might not be a bad idea to

As Brendan mentions in the comments, you should be generating a ton of documentation between steps 3 and 6. If you just keep writing down what you're doing and why as you do things, it'll take you 30 minutes longer but it'll leave you with a solid plan for next time. When you're done, there may have been unneccessary steps you can skip next time so make sure you add a conclusion.

I would also be tempted to drop the previous owner and their boss a note about the state of the server and how dangerously negligent lapsed security updates are. You can do this without sounding like an interfering tool but that's optional.

| improve this answer | |
  • 8
    "toss it into the sea" :) – don.joey Aug 27 '13 at 13:58
  • Well, sounds like I'll be biting the bullet and building a new server. Thanks for the input. – jon_brockman Aug 27 '13 at 14:35
  • 2
    I'd also look into virtualization - Virtualize the server as is, then snapshot and you now have a backup and a playground. Try stuff, success? snapshot, else rollback and try again. Same for starting from scratch. Try, Snapshot or revert. – WernerCD Aug 27 '13 at 16:15
  • 4
    This is great information. The only thing I'd add is that in step 4, document what you did so it's easier for the next person. – Brendan Long Aug 27 '13 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.