Updating Debian on the Appliance

Updating Debian 9 to 10

With the release of Login Enterprise 4.7, we recommend updating your Debian version to 10.

This only applies to Login Enterprise Appliances upgraded to 4.7 from 4.6 or lower. New installations using 4.7 and higher will have Debian 10 already installed. Older versions 4.6 and lower can't update to Debian 10.

Verification

To check if you need to upgrade to Debian 10, open an SSH or console connection to your appliance and log in to the console.

At the top of the screen, you can see a message stating "System Update Required!"

If you do not see this, no update is required.

Online Update (Strongly Recommended)

The update sequence is very simple and straightforward when your appliance is connected to the internet. Go to the Updates section on your appliance console and select System update from the internet.

When initiated, you are asked for verification of the update.

Once the update is initiated, Debian will start downloading the necessary files to complete the update. This process can take about 10 minutes, depending on internet speed and hardware.

When the update process is completed, you are asked to press Enter.

When you log out and log in to the console again, you can see that the message at the top of the screen is gone.

Offline Update

With the release of 4.7, you can now do an offline update to Debian 10. This happens during the upgrade to Login Enterprise 4.7.

The update process is similar to the default update from iso process as described in Updating the Appliance. The only difference is that after the Important notice, you are shown a different message that explains the importance of the Debian upgrade.

When you see the message, the installation for Login Enterprise 4.7 has already started. Once the update for Login Enterprise is completed, you are asked if you wish to update to Debian 10.

If you select yes, the system update will start. If you select no, the update process will be stopped, and you can return to the main page. If you selected no and still want to offline update, repeat the update process as described in this article.

If you have selected to update Debian and the update has been completed, you are asked to reboot the appliance.

After the reboot, you can verify your Debian version by logging in to the console and opening the bash shell from the troubleshooting section. On this page, simply type lsb_release -a. It should show you the new version of Debian.

Updating Debian 10 to 12

Since the 4.7 release, Login Enterprise has been running on Debian 10. However, Debian 10's LTS period ends on June 30th, 2024. For details, see the Debian Long-Term Support Matrix.

Starting with the 5.9 release, new Login Enterprise installations will come with Debian 12 by default. Existing Login Enterprise installations (4.7-5.8) can upgrade Debian OS from 10 to 12 by updating to the latest Login Enterprise release.

To receive the latest security updates on your System, we strongly advise upgrading to Debian 12 after the Login Enterprise upgrade is completed.

Isolated/Offline Environments

The Login Enterprise upgrade ISO contains all the necessary packages to facilitate a Debian 10 to 12 upgrade in an offline scenario—no internet connectivity is required.

Troubleshooting

Missing Packages in Login Enterprise Updates

Starting with Login Enterprise 5.10, the system will detect if the Debian package manager cannot locate or download a required package. In such cases, the appliance will:

Provide information on how to supply the missing package.
Prompt the operator to decide whether to continue with the update.

This scenario is likely if your appliance is behind a firewall that restricts access to external systems.

Manually Retrieving Missing Packages

If automatic package updates are not possible, you can manually retrieve the missing packages, upload them to the appliance, and then retry the update. This process should resolve the issue.

Error Message Example

When you run a Login Enterprise update and choose to include a system update, the process may fail with messages similar to the following:

CODE

After this operation, 883 MB of additional disk space will be used.
Err:1 https://deb.debian.org/debian bookworm/main amd64 libtcl8.6 amd64 8.6.13+dfsg-2
Could not connect to debian.map.fastly.net:443 (146.75.30.132). - connect (113: No route to host) Unable to connect to deb.debian.org:https:
Err:2 https://deb.debian.org/debian bookworm/main amd64 tcl8.6 amd64 8.6.13+dfsg-2
Unable to connect to deb.debian.org:https:
Err:3 https://deb.debian.org/debian bookworm/main amd64 tcl-expect amd64 5.45.4-2+b1
Unable to connect to deb.debian.org:https:
Err:4 https://deb.debian.org/debian bookworm/main amd64 expect amd64 5.45.4-2+b1
Unable to connect to deb.debian.org:https:
Err:5 https://deb.debian.org/debian bookworm/main amd64 javascript-common all 11+nmu1
Unable to connect to deb.debian.org:https:
Err:6 https://deb.debian.org/debian bookworm/main amd64 libxapian30 amd64 1.4.22-1
Unable to connect to deb.debian.org:https:
Err:7 https://deb.debian.org/debian bookworm/main amd64 psmisc amd64 23.6-1
Unable to connect to deb.debian.org:https:
Download complete and in download only mode
E: Failed to fetch https://deb.debian.org/debian/pool/main/t/tcl8.6/libtcl8.6_8.6.13+dfsg-2_amd64.deb Could not connect to debian.map.fastly.net:443 (146.75.30.132). - connect (113: No route to host) Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/t/tcl8.6/tcl8.6_8.6.13+dfsg-2_amd64.deb Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/e/expect/tcl-expect_5.45.4-2+b1_amd64.deb Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/e/expect/expect_5.45.4-2+b1_amd64.deb Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/j/javascript-common/javascript-common_11+nmu1_all.deb Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/x/xapian-core/libxapian30_1.4.22-1_amd64.deb Unable to connect to deb.debian.org:https:
E: Failed to fetch https://deb.debian.org/debian/pool/main/p/psmisc/psmisc_23.6-1_amd64.deb Unable to connect to deb.debian.org:https:
Warning: The following package(s) couldn't be downloaded:
libtcl8.6_8.6.13+dfsg-2_amd64.deb MD5Sum:017076f7f43bc9eee3355b21ec42cd16
tcl8.6_8.6.13+dfsg-2_amd64.deb MD5Sum:02ca287da37704e9df6ee0b06bd479c4
tcl-expect_5.45.4-2+b1_amd64.deb MD5Sum:88db84877ab2d4711b173e16f88cb6c5
expect_5.45.4-2+b1_amd64.deb MD5Sum:52a0d8ad1f8c18df2dd31fe6e39bfd63
javascript-common_11+nmu1_all.deb MD5Sum:f045ec32a84a135b9c218a227a07ead0
libxapian30_1.4.22-1_amd64.deb MD5Sum:f0b31ea1fb3e186af9266aad1166130e
psmisc_23.6-1_amd64.deb MD5Sum:2a758475a05809ab3080de96f9478401
Check the log at /loginvsi/missing_packages. You may need to download these packages manually and upload them to the "/var/cache/apt/archives" directory.
Do you want to proceed with the update? (Make sure you have a snapshot to revert to) [y/N]:

Handling Download Errors

If multiple packages fail to download (as indicated by the Err: and E: lines in the error message example above), the system will detect these errors and prompt you at the end, asking whether you want to continue.

Unless you are certain it is safe to proceed (or you have a VM snapshot to revert to), you should respond with n and follow the instructions below to manually provide the missing packages to your appliance.

Common Errors and Solutions

Unable to connect to deb.debian.org.
- This error suggests that the appliance cannot reach the Internet at all, possibly due to basic connectivity issues or DNS errors like Temporary failure resolving 'http://deb.debian.org'

Certificate verification failed: The certificate is NOT trusted.
- This error indicates that you can reach the Internet, but something interfered with the certificate on deb.debian.org, such as a packet-inspecting firewall.
- To resolve this:
  - Respond with n to continue the upgrade.
  - Go to the Troubleshooting menu, and select Ignore certificate errors.

Choose Set apt config to tell the Debian package manager to ignore certificate errors.

Try the upgrade process again.

Manually Downloading and Uploading Packages

If you cannot use the Internet to download additional packages directly to the appliance, follow these steps:

Download the required packages to a machine with Internet access.

Upload the packages to the appliance.

Once the packages are uploaded, you can safely rerun the upgrade process.

If the upgrade process fails, follow these instructions:

Check the log file at /loginvsi/missing_packages.

This file contains failure information and URLs that Debian attempted to use.
The log file will look similar to this:

CODE

'https://deb.debian.org/debian/pool/main/t/tcl8.6/libtcl8.6_8.6.13+dfsg-2_amd64.deb' libtcl8.6_8.6.13+dfsg-2_amd64.deb 1034548 MD5Sum:017076f7f43bc9eee3355b21ec42cd16
'https://deb.debian.org/debian/pool/main/t/tcl8.6/tcl8.6_8.6.13+dfsg-2_amd64.deb' tcl8.6_8.6.13+dfsg-2_amd64.deb 120328 MD5Sum:02ca287da37704e9df6ee0b06bd479c4
'https://deb.debian.org/debian/pool/main/e/expect/tcl-expect_5.45.4-2+b1_amd64.deb' tcl-expect_5.45.4-2+b1_amd64.deb 133128 MD5Sum:88db84877ab2d4711b173e16f88cb6c5
'https://deb.debian.org/debian/pool/main/e/expect/expect_5.45.4-2+b1_amd64.deb' expect_5.45.4-2+b1_amd64.deb 165996 MD5Sum:52a0d8ad1f8c18df2dd31fe6e39bfd63
'https://deb.debian.org/debian/pool/main/j/javascript-common/javascript-common_11+nmu1_all.deb' javascript-common_11+nmu1_all.deb 6260 MD5Sum:f045ec32a84a135b9c218a227a07ead0
'https://deb.debian.org/debian/pool/main/x/xapian-core/libxapian30_1.4.22-1_amd64.deb' libxapian30_1.4.22-1_amd64.deb 1100156 MD5Sum:f0b31ea1fb3e186af9266aad1166130e
'https://deb.debian.org/debian/pool/main/p/psmisc/psmisc_23.6-1_amd64.deb' psmisc_23.6-1_amd64.deb 258696 MD5Sum:2a758475a05809ab3080de96f9478401

Download the log file using WinSCP or another SFTP client with the admin account.

Manually download the necessary packages listed in the log file.

On any machine with Internet access, download each URL listed in the log file at /loginvsi/missing_packages.
Remove any single-quote characters from the URLs.

Upload the packages to the appliance:

Using WinSCP or another SFTP client, log in as admin.
Change the remote directory to /var/cache/apt/archives.
Upload all the DEB files you downloaded.

Rerun the upgrade process.

For your system, the packages may vary and could be numerous.

Handling Additional Package Discoveries

After downloading an initial set of files, Debian Linux may discover additional packages it did not initially identify. You may need to repeat this process. The previous DEB packages will still be present on the appliance, so you only need to download and upload the newly listed ones.

Continuing with Missing Packages

You can choose to continue with the upgrade process even if there are missing packages by responding with y. Most missing packages are for non-system components, and Linux can operate safely without upgrading them. At worst, specific programs may not function properly while the rest of the system is upgraded. If you have a snapshot to revert to, you can always attempt to continue the upgrade if you think the remaining packages are unimportant.

If you have any questions or concerns about updating Debian, feel free to reach out to our support at support@loginvsi.com.