Lab: Package operations end-to-end

This lab walks through the daily package operations on a production host. Each task is a routine action; together they exercise the full lifecycle.

Objective

By the end of this lab, you can update the package index, upgrade installed packages, query the package database, hold a critical package, and clean the package cache.

Architecture

flowchart LR
  U[Update index]
  Q[Upgrade packages]
  Q2[Query database]
  H[Hold critical package]
  A[Audit cache]
  C[Clean cache]

  U --> Q --> Q2 --> H --> A --> C

Requirements

A Linux host (Ubuntu 24.04 LTS or Debian 12 preferred; RHEL-family equivalent commands in parentheses).
Root or sudo access.

Scenario

You inherit a Linux host. Audit its package management state, apply routine updates, hold a critical package, and clean the cache.

Tasks

Task 1: Audit current state

# Debian-family
apt list --installed 2>/dev/null | wc -l
apt-mark showhold
du -sh /var/cache/apt/archives/

# RHEL-family
dnf list installed | wc -l
dnf versionlock list
du -sh /var/cache/dnf/

Record:

Total installed packages.
Currently held packages.
Cache size.

Task 2: Update and upgrade

sudo apt update
sudo apt upgrade -y
# RHEL-family:
# sudo dnf upgrade -y

Note what was upgraded. Read the output for warnings (deprecated packages, held-back updates).

Task 3: Query the package database

# Debian-family
dpkg -S /etc/ssh/sshd_config
dpkg -L openssh-server | head

# RHEL-family
rpm -qf /etc/ssh/sshd_config
rpm -ql openssh-server | head

For each command, identify:

Which package owns a file.
Which files a package installed.
The version of the package.

Task 4: Hold a critical package

# Debian-family
sudo apt-mark hold openssh-server
apt-mark showhold

# RHEL-family
sudo dnf versionlock add openssh-server
dnf versionlock list

After this:

apt-mark showhold

Confirm openssh-server is held.

Task 5: Audit and clean the cache

du -sh /var/cache/apt/archives/
sudo apt autoclean
du -sh /var/cache/apt/archives/

After autoclean, the cache should be smaller (older packages removed). Current versions remain.

Task 6: Document

Save the outputs to a file:

OUTDIR=/tmp/package-lab-$(date +%Y%m%d-%H%M%S)
mkdir -p $OUTDIR
apt list --installed > $OUTDIR/installed.txt
apt-mark showhold > $OUTDIR/holds.txt
dpkg -S /etc/ssh/sshd_config > $OUTDIR/owner.txt
du -sh /var/cache/apt/archives > $OUTDIR/cache.txt
tar -czf $OUTDIR.tgz $OUTDIR

Validation

The lab is complete when:

The package index has been updated.
The upgrade was applied (or no upgrades were available).
You can identify which package owns a given file.
A critical package is held and the hold is confirmed.
The cache has been cleaned with autoclean.
A saved evidence directory captures the state.

Expected outcome

A host with up-to-date packages, a documented hold, and a clean cache. The evidence directory is a snapshot of the host’s package management state for post-incident review.

Troubleshooting

apt update fails — check the network and the configured repositories in /etc/apt/sources.list. An unreachable mirror causes apt to retry indefinitely.
Upgrade is held back — three different causes, three different answers. Work through them in order.
1. An explicit hold: apt-mark showhold lists it. Unhold with apt-mark unhold if the reason for the hold has passed.
2. A phased update (Ubuntu): apt-cache policy <package> shows the phasing. Wait for the rollout. full-upgrade does not bypass phasing, so reaching for it here just hides the real question.
3. Neither of the above: apt reported it under “kept back” because the upgrade needs a removal, and apt upgrade never removes. Simulate with sudo apt-get -s dist-upgrade, read every Remv line, then run apt full-upgrade. Never leave a kept-back package uninvestigated — N not upgraded on a patch run means N updates, possibly including the CVE fix, were not applied.
autoremove would remove a package you need — re-install it explicitly: apt install <package>. The package manager then knows it is needed and will not remove it again.

Cleanup

# Remove the hold
sudo apt-mark unhold openssh-server
# Or for RHEL-family:
# sudo dnf versionlock delete openssh-server

The lab state is otherwise non-destructive.

What you learned

You can now update, query, hold, and clean packages on a production host. The discipline is to update before installing, hold critical packages, query the database when investigating, and clean the cache to control disk usage.

Objectives

Prerequisites