2

I'm using Ubuntu Server 14.04.2 LTS and hosting wordpress on it. I installed it from the packages via apt-get.

Now wordpress complains almost every day about available updates per mail and that an auto-update has failed. Trying to update it from the wordpress dashboard fails as well.

So my general question is: what is the best practice on updating wordpress on ubuntu?

  1. Going with the ubuntu packages only. If there are any security problems with the ubuntu version, will it be fixed automatically via the daily security updates? If so, how one can disable the nagging update emails?

  2. Going with the wordpress updates directly. Besides making that work within ubuntu, is that recommended? What happens, if I performed updates via wordpress directly, but now comes and update from the package manager? Will it probably downgrade my wordpress? Will it maybe break the updated package?

  3. Going with a "native" wordpress installation. Forgetting about the ubuntu wordpress packages at all and install wordpress via tar.gz or whatever.

To be clear: I'm not after the latest wordpress features and fancy plugins, but after a stable, security-managed version.

Any recommendations?

2

You could go with either the first or third option, but your middle option is not really cleanly possible.

  1. Going with the ubuntu packages only

If you do this, you rely on Ubuntu for security updates rather than getting them from Wordpress. The advantage to this is that you'll benefit from the work Ubuntu (well, Debian) has done getting Wordpress to integrate well with your OS and it'll be easy to set up. But the disadvantage is you will stay on older versions.

As for security support, the wordpress package is in "universe" meaning that Ubuntu don't promise to give official security support. It also means that it's imported with relatively few changes from Debian's repositories, so ultimately security support will depend both on Debian and on Ubuntu's ability to migrate across any major bug fixes. If your PHP and MySQL installation is securely set up in general, this will probably be fine.

The nagging you get about updates would probably be considered a bug by Debian and/or Ubuntu, but they can't/won't fix it because only security related issues are important enough to fix in an existing release. So in other words it may be fixed in a future version of Ubuntu, who knows.

  1. Going with the wordpress updates directly.

You won't be able to get this working cleanly if you're using Ubuntu's wordpress packages. If you did, as you said, an update from Ubuntu would wipe away and potentially downgrade all the changes you did. Modifying files installed by Ubuntu packages is not recommended in most cases.

  1. Going with a "native" wordpress installation.

This would be my recommendation in this case as you will be able to upgrade it on your own schedule and get updates directly from Wordpress.

1

In my experience #3 will serve your purpose, since the native WordPress updater works well. As you've already found, it also conflicts with Ubuntu packaging.

On LTS, don't expect patches other than for stability and security. The 14.04.1 Wordpress package is on version 3.8.2+dfsg-1ubuntu0.1. Upstream is at 4.2.2. There does not seem to be a Vivid backport available.

Here are my notes from a quick 4.4.2 Wordpress.org test install on 14.04.1:

sudo apt-get install apache2 libapache2-mod-php5 php5-mysql mysql-server ## write down password for mysql root user
sudo service apache2 reload
wget https://wordpress.org/latest.tar.gz
tar xzvf latest.tar.gz
sudo mv wordpress/ /var/www/html/
sudo chown -R www-data.root /var/www/html/wordpress/

mysql -u root -p ##enter password at prompt
create database my_wordpress;
create user 'my_wordpress'@'localhost' identified by 'my_password';
grant all on my_wordpress.* to 'my_wordpress'@'localhost';
exit

Visit localhost/wordpress in your browser and follow the wizard to complete setup. A virtual host would be a good idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.