[SOLVED] apt does not see security update

[cschnaars]

Hello:

I have been reading up on how to keep Debian secure and have updated dozens of packages on a couple of servers running Debian Buster. I had no problems until yesterday when I tried to update apache2 in response to a security update issued by the Debian security team. However, I have not been able to get my servers to "see" the update. When I run apt upgrade and apt list --upgradable, the system returns nothing.

I thought the problem might be in sources.list. The file looked ok to me, since it explicitly refers to Buster and so I don't have to change stable to oldstable, but I added contrib and non-free to all lines and also added a line to explicitly point to security updates. My system still doesn't see the update. Here are the contents of my sources.list file:

deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free

deb http://security.debian.org/debian-security buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security buster/updates main contrib non-free

# Added this line on 1/4/22 to see if it helps to find security updates
deb http://security.debian.org/debian-security buster-security main contrib non-free

# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free

The security update says the bugs identified are fixed in version 2.4.38-3+deb10u7. I verified I am running 2.4.38-3+deb10u6. Does anyone know what I'm doing wrong? Thank you.

[FreewheelinFrank]

The debian-security part is Bullseye - in Buster was just debian. I know because I edited my sources.list this morning to update Buster to Bullseye on a computer.

Try:

Code: Select all

deb http://deb.debian.org/debian buster/security main contrib non-free

[cschnaars]

So I added the repo definition you suggested to my sources.list file. My system still does not see the apache2 update. Any other ideas?

[FreewheelinFrank]

Have you done

Code: Select all

# apt update

?

[cschnaars]

Yes. Here is the output.
Hit:1 http://deb.debian.org/debian buster InRelease
Ign:2 http://deb.debian.org/debian buster/security InRelease
Hit:3 http://deb.debian.org/debian buster-updates InRelease
Err:4 http://deb.debian.org/debian buster/security Release
404 Not Found [IP: 146.75.34.132 80]
Hit:5 https://packages.microsoft.com/debian/10/prod buster InRelease
Reading package lists... Done
E: The repository 'http://deb.debian.org/debian buster/security Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Current content of sources.list: (I have not altered anything in response to the error returned above.)
deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free

#deb http://security.debian.org/debian-security buster/updates main contrib non-free
#deb-src http://security.debian.org/debian-security buster/updates main contrib non-free

#deb http://security.debian.org/debian-security buster-security main contrib non-free
deb http://deb.debian.org/debian buster/security main contrib non-free

# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free

[FreewheelinFrank]

Sorry, if you'd asked me this morning I could've told you straight away what the repository was on Buster, but now that computer is running Bullseye. It doesn't help that debian.org lists two different security repositories and the format has changed.

Could you try:

Code: Select all

deb http://security.debian.org/ buster/updates main contrib non-free

Edit: I think this one is right - it's from the Debian handbook for Buster. The previous one I found on the Debian User Forum - obviously a source of dubious misinformation.

https://debian-handbook.info/browse/stable/apt.html

I also ran into the same problem in Buster and blogged about it, but unfortunately didn't remember the post at first.

https://dontsurfinthenude.blogspot.com/ ... wrong.html

[cschnaars]

Unfortunately, the updated code also does not work.

I had no trouble getting security-specific updates in the past. I presume the problem is related to the fact Buster has gone from stable to oldstable. Now I'm wondering if there is some dependency or something else on my system that is blocking the upgrade. I got my initial repo settings from the handbook as well.

Thank you very much for trying to help me. Hoping you or someone else has other ideas. It's got to be something simple.

[cschnaars]

Just for the heck of it, I just tried to update the package directly. My system does not see the new version:
$ sudo apt install apache2
Reading package lists... Done
Building dependency tree
Reading state information... Done
apache2 is already the newest version (2.4.38-3+deb10u6).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

[zwab]

Code: Select all

@:/# cat /etc/apt/sources.list
#

# deb cdrom:[Official Debian GNU/Linux Live 10.10.0 cinnamon 2021-06-19T12:44]/ buster main

# deb cdrom:[Official Debian GNU/Linux Live 10.10.0 cinnamon 2021-06-19T12:44]/ buster main

# Line commented out by installer because it failed to verify:
#deb http://security.debian.org/debian-security buster/updates main
# Line commented out by installer because it failed to verify:
#deb-src http://security.debian.org/debian-security buster/updates main

# buster-updates, previously known as 'volatile'
# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.
#
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free

deb http://deb.debian.org/debian buster main contrib non-free
deb-src http://deb.debian.org/debian buster main contrib non-free

#deb http://deb.debian.org/debian-security/ buster-security main contrib non-free
#deb-src http://deb.debian.org/debian-security/ buster-security main contrib non-free

deb http://security.debian.org/debian-security/ buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security/ buster/updates main contrib non-free

deb http://security.debian.org/ buster/updates main contrib non-free
#you need this ^^^^^

Code: Select all

apt update -y && apt upgrade -y

[cschnaars]

This worked! Thank you very much! And thank you, FreewheelinFrank, for all your time in helping me to chase this down.

[FreewheelinFrank]

There seem to be two security repositories in that list. Which one worked?

[zwab]

There seem to be two security repositories in that list. Which one worked?

It's this one:

Code: Select all

deb http://security.debian.org/ buster/updates main contrib non-free

[FreewheelinFrank]

There seem to be two security repositories in that list. Which one worked?

It's this one:

Code: Select all

deb http://security.debian.org/ buster/updates main contrib non-free

Seems to be exactly the same one I posted earlier that didn't work.

Could you try:

Code: Select all

deb http://security.debian.org/ buster/updates main contrib non-free

Unfortunately, the updated code also does not work.

deb http://security.debian.org/ buster/updates main contrib non-free
#you need this ^^^^^[/code]

Code: Select all

apt update -y && apt upgrade -y

This worked! Thank you very much!

[cschnaars]

FreewheelinFrank you're right. This is the code you posted earlier. The only thing I can figure is that in patching sources.list, apt must not have liked one of the URLs listed before the correct one you provided.

Yesterday I patched our Staging server. I patched our Production server this morning by changing these two lines in sources.list:
deb http://security.debian.org/debian-security buster/updates main
deb-src http://security.debian.org/debian-security buster/updates main

To this:
deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free

With these two lines in place, apache2 updated right away.

Thanks again to both of you for your help.

[FreewheelinFrank]

No problem.

Bear in mind that the former is correct for Debian 11, so if you ever update you will see the same errors with what are now your working repositories until you change them again.