2

In /etc/apt/sources.list(lists APT data sources) file there are two repositories listed for security updates:

deb http://security.debian.org/ wheezy/updates main contrib non-free
deb-src http://security.debian.org/ wheezy/updates main contrib non-free

Why are security updates kept separately from normal package updates? What are the best practices if I would like to update all my installed packages(apt-get upgrade) with latest security patches, but not to install any additional features or install newer version of the packages? Should I just comment out non-security ATP data sources from /etc/apt/sources.list before apt-get upgrade?

2

The separated repository is two fold:

  • To keep all security related upgrades easily identifiable, since they come from a different domain and with different suite.
  • To expedite all the security related upgrades and provide an unique mirror to assure maximum availability in the shortest time, since mirrors sync with Debian's on regular basis which defeats the propose of being able to patch as many systems is possible.

    Actually, there are. There are several official mirrors, implemented through DNS aliases. The purpose of security.debian.org is to make security updates available as quickly and easily as possible.

What are the best practices if I would like to update all my installed packages(apt-get upgrade) with latest security patches, but not to install any additional features or install newer version of the packages?

If you want really a hardened system, I recommend reading the "Securing Debian Manual" first (through some sections may need revision in general is fine).

Should I just comment out non-security ATP data sources from /etc/apt/sources.list before apt-get upgrade?

No, that's just disabling any non-security package installation that you may want. Is not the recommended course of action.

Q: What is the policy for a fixed package to appear in security.debian.org?

A: Security breakage in the stable distribution warrants a package on security.debian.org. Anything else does not.

The security.debian mirror only includes security related upgrades. If you want to install a package that never has got a security related upgrade, apt will not find the package, giving you headaches enabling the mirrors just to disable them again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.