主题： debian
-
将 Debian 和 Ubuntu 升级到下一个主版本，同时保留回退途径
Ubuntu 的 do-release-upgrade 和 Debian 先手动修改软件源列表再升级的流程，都以完整备份和备用控制台访问为前提，以应对升级中途 SSH 会话断开的情况；Debian 自己的发行说明建议先进行最小升级，再进行完整升级。
-
Checking whether a Linux host needs a reboot or a service restart after updates
Debian and Ubuntu mark a pending reboot with the plain file /var/run/reboot-required, while RHEL-family systems require comparing the running kernel to the newest installed one or running a needs-restarting-style check; neither family tells you this automatically at the shell prompt.
-
Configuring network interfaces with netplan on Ubuntu, and testing changes without losing the connection
Netplan renders YAML under /etc/netplan into networkd or NetworkManager configuration; `netplan try` applies a change and automatically reverts it if nobody confirms within a timeout, which is the safe way to change network settings on a remote host. Debian's ifupdown /etc/network/interfaces is the older, still-supported contrast.
-
Setting locale, timezone and reconfiguring packages non-interactively on Debian and Ubuntu
localectl, timedatectl and update-locale change locale and timezone without a text-mode dialog, and dpkg-reconfigure -f noninteractive re-runs a package's debconf-driven setup the same way a script would run the original install, both usable in provisioning scripts with no terminal attached.
-
以当前方式添加第三方 APT 仓库：deb822 .sources 文件与 Signed-By 密钥环
apt-key 已弃用；受支持的添加签名第三方仓库方式，是在 /etc/apt/keyrings 下放置密钥环文件并用 Signed-By 选项引用，配置可写成传统单行形式或较新的 deb822 .sources 格式，Debian 12/13 和当前 Ubuntu 版本都能解析。
-
使用 debsums 和 dpkg --verify 检查 Debian、Ubuntu 已安装包的完整性
debsums 将已安装文件与软件包构建时记录的 MD5 校验和进行比较；dpkg --verify（自 dpkg 1.17.2 起）比较 dpkg 数据库本身记录的元数据；dpkg -S/-L 则在决定是否重新安装之前回答“哪个包拥有这个文件”和“这个包安装了哪些文件”。
-
Adding a private CA to the system trust store on RHEL-family and Debian/Ubuntu
RHEL-family and Debian-family Linux keep separate mechanisms for adding a locally trusted CA certificate: update-ca-trust with anchors under /etc/pki/ca-trust, and update-ca-certificates with .crt files under /usr/local/share/ca-certificates. Using the wrong directory or extension silently leaves the CA untrusted.
-
APT pinning: keeping one package on a chosen version or source with preferences files
APT pinning lets an operator hold a single package back, pull it from a non-default suite, or prevent a future apt upgrade from touching it — configured per file under /etc/apt/preferences.d rather than by editing one shared file, and inspected with apt-cache policy.
-
Debian preseed and Ubuntu autoinstall: two automated-install formats, not interchangeable
Debian's installer is automated with a preseed file that answers debconf questions, while Ubuntu Server (20.04+) and Desktop (23.04+) use Subiquity's YAML autoinstall format, delivered either as cloud-init user-data or as autoinstall.yaml on the install media. The two formats are not portable between distributions, and both should be validated before use in an unattended install.
-
Managing installed kernels on Debian and Ubuntu: cleanup, /boot space, HWE and Livepatch
Old kernel packages accumulate in /boot until apt autoremove clears them; Ubuntu additionally offers a rolling Hardware Enablement (HWE) kernel on LTS releases and Canonical's Livepatch service for applying kernel security fixes without an immediate reboot — both Ubuntu-specific, with no Debian equivalent.
-
Running apt and dpkg non-interactively on Debian and Ubuntu without hanging on prompts
A scripted apt-get or dpkg run can stall on a debconf prompt, a modified-conffile question or a held dpkg lock. Setting DEBIAN_FRONTEND, the right confold/confdef options and preseeding debconf answers first turns an install into a command that either finishes or fails loudly.
-
Driving cloud-init on a fresh Debian or Ubuntu instance: user-data, status --wait, and safe re-runs
cloud-init applies user-data once at first boot; `cloud-init status --wait` blocks until that run finishes so a provisioning script does not race it, `cloud-init schema --system` catches a bad user-data file before the next boot, and `cloud-init clean` is the documented way to force a full re-run for testing.
-
配置 unattended-upgrades，在 Debian 和 Ubuntu 上自动安装安全补丁
unattended-upgrades 通过定时器应用软件包更新，使用两个文件：20auto-upgrades（是否更新及频率）和 50unattended-upgrades（使用哪些来源及是否重启）。在生产环境启用之前用 --dry-run --debug 测试，可避免意外重启或只完成一半的升级。
-
Working with AppArmor profiles on Debian and Ubuntu: status, complain mode and local overrides
AppArmor confines individual programs by profile rather than by user; aa-status shows what is loaded and enforced, aa-complain/aa-enforce switch a profile between logging-only and blocking, and /etc/apparmor.d/local holds site-specific additions that survive package upgrades of the shipped profile.
机器可读： JSON