如何平滑安全升级你的Debian系统

此文以 Debian 11 bullseye 为例，讲述如何从 Debian 11 平滑升至 Debian 12。不涉及重装系统，仅以命令行操作

What's New in Bookworm

简单介绍一下 Debian 12 bookworm 的新特性（变化）

占 Bullseye 软件包总数的 67% 的软件包得到更新，约占 bullseye 软件包总数的 10%的软件包在此版本中被删除

新增软件仓库分区：non-free-firmware

大量软件包得到更新（相较于 Bullseye）：如

• Linux 内核映像: 5.10 系列 --> 6.1 系列
• OpenJDK: 11 --> 17
• OpenSSH: 8.4.p1 -->9.2p1
• PHP: 7.4 --> 8.2
• vim: 8.2 --> 9.0

······

Upgrade from Bullseye

Replace with sed

用 sed 命令将 /etc/apt/sources.list文件中，将所有匹配到的 bullseye 替换为 bookworm，下次 apt 更新时即会在 bookworm 软件源中获取；同理存放 list 的 sources.list.d 目录中也需要替换

自 Debian 11 bullseye 开始，安全更新套装已从 codename/security 重命名为 codename-security，codename 即 Debian 每个版本的代号，如 10 --> Buster，11 --> Bullseye，12 --> Bookworm

自 Debian 12 bookworm 开始，仓库添加非自由固件组件 non-free-firmware

sed -i 's/bullseye/bookworm/g' /etc/apt/sources.list
sed -i 's/bullseye/bookworm/g' /etc/apt/sources.list.d/*.list

#可选项
sed -i 's/non-free/non-free non-free-firmware/g' /etc/apt/sources.list

更改后的 source.list 文件内容示例如下，当然你可以用 nano, vim, 或是 cat 来检查 list 是否无误

#示例1
# deb cdrom:[Debian GNU/Linux 11.5.0 _Bullseye_ - Official amd64 NETINST 20220910-10:38]/ bookworm main

#deb cdrom:[Debian GNU/Linux 11.5.0 _Bullseye_ - Official amd64 NETINST 20220910-10:38]/ bookworm main

deb http://ftp.us.debian.org/debian bookworm main
deb-src http://ftp.us.debian.org/debian bookworm main

deb http://security.debian.org/debian-security bookworm-security main
deb-src http://security.debian.org/debian-security bookworm-security main

# bookworm-updates, to get updates before a point release is made;
# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports
deb http://ftp.us.debian.org/debian bookworm-updates main
deb-src http://ftp.us.debian.org/debian bookworm-updates main

# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.

#示例2
deb http://deb.debian.org/debian bookworm main
deb-src http://deb.debian.org/debian bookworm main
deb http://security.debian.org/debian-security bookworm-security main
deb-src http://security.debian.org/debian-security bookworm-security main
deb http://deb.debian.org/debian bookworm-updates main
deb-src http://deb.debian.org/debian bookworm-updates main
deb http://deb.debian.org/debian bookworm-backports main
deb-src http://deb.debian.org/debian bookworm-backports main

apt update & upgrade

更改完 source.list 文件后更新 apt 并 upgrade

apt update
apt upgrade -y
apt dist-upgrade -y
apt full-upgrade -y

apt 更新完后，注意检查是否无误，若无误最好重启系统

reboot

Console

apt upgrade 时默认选择

默认选择保留 iptables 的 ipv4 or ipv6 的规则，

默认选择保留原来的 sshd_config，如果选第 1 个，之前的配置会被覆盖掉

由于本次测试的 BuyVM server 无 grub，因此 reboot 后还是旧内核，需要重新安装 grub2 并适当配置才能换到新内核（上次问 frantech 老板没解决此问题，现在此问题已解决）

参考资料

第 5 章 bullseye 中需要注意的问题 (debian.org)

Firmware - Debian Wiki

第 2 章 Debian 12 的新变化