Offline Update/Upgrade Ubuntu Server 16.04.2

Background:

The Ubuntu server is in the restricted zone that doesn’t have Internet access. It was built from image “ubuntu-16.04.2-server-amd64.iso” (http://releases.ubuntu.com/16.04.2/). Nessus Scan showed it has 2 critical, 12 high, 3 medium and 1 low risk vulnerabilities.

It needs to be patched and pass the Nessus Scan. Google “offline ubuntu update” directed me to these Links: https://help.ubuntu.com/community/AptGet/Offline and https://wiki.ubuntu.com/OfflineUpdateSpec). However, I tried all the methods that the document mentioned, for some reasons they didn’t work for me:

1. Synaptic and Keryx needs GUI and Ubuntu server doesn’t have it by default.
2. The Tool apt-offline needs to be installed in the offline server in order to use it. This is tricky because the offline server doesn’t have internet to apt-get install it.
3. Not sure why but I couldn’t get apt-medium working on the Virtual Machine that I used to test the offline upgrade. It didn’t download any packages.

Solution:

After some researches, the issue can be solved by a few command lines. The solution is based on below facts:

1. Ubuntu saves all the packages in folder /var/cache/apt/archives and the list in /var/lib/apt/lists after update/upgrade.
2. The package index is saved in /etc/apt/sources.list file and in the /etc/apt/sources.list.d directory.
3. Offline installation can use command “sudo dpkg -i “ following by “sudo apt-get install -f”

Requirement for Test Environment:

1. Local Ubuntu Server 16.04.2 LTS without Internet Access.
2. Remote machine that has Vmware or Virtual box and Internet access.
3. Ubuntu Server 16.04.2 LTS image
4. A USB key or a blank CD.

Steps:

1. Install an Ubuntu Server 16.04.2 LTS virtual machine on VMware or Virtual Box. 

2. (optional) Run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates. The result is x;y (x=packages can be updated. y=security updates)

 

3. Run below commands to patch the Ubuntu VM:

               sudo apt-get update

               sudo apt-get upgrade

               sudo apt-get dist-upgrade

4. (optional) you can run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates again, it should be “0;0”.

5. Run below commands to create an offline repository.

              mkdir -p /tmp/offline/var/cache/apt/archives

              mkdir -p /tmp/offline/var/lib/apt/lists

              mkdir -p /tmp/offline/etc/apt

              mkdir -p /tmp/offline/etc/apt/sources.list.d

              sudo cp /var/cache/apt/archives/*.deb  /tmp/offline/var/cache/apt/archives

              # Might get warning message: cp: omitting directory '/var/lib/apt/lists/partial'

              # It can be ignored. 

              sudo cp /var/lib/apt/lists/*  /tmp/offline/var/lib/apt/lists

              sudo cp /etc/apt/sources.list /tmp/offline/etc/apt

              sudo cp -r /etc/apt/sources.list.d /tmp/offline/etc/apt/

              # Remove file /tmp/offline/var/lib/apt/lists/lock since it is no needed. 

              sudo rm -f /tmp/offline/var/lib/apt/lists/lock

 

6. Copy /tmp/offline to a USB key or use mkisofs to generate an ISO file

 

7. Connect the USB key to the local Ubuntu Server that doesn’t have Internet. Mount the USB key and copy the offline folder to /tmp folder.

               sudo mkdir -p /mnt/usb

               sudo mount /dev/sdb1 /mnt/usb

               sudo cp -rf /mnt/usb/offline /tmp

 

8. Run below commands to build the repository. 

               sudo cp -f /tmp/offline/var/cache/apt/archives/* /var/cache/apt/archives/

               sudo cp -f /tmp/offline/var/lib/apt/lists/* /var/lib/apt/lists/

               sudo cp -f /tmp/offline/etc/apt/sources.list /etc/apt/sources.list

               sudo cp -f /tmp/offline/etc/apt/sources.list.d/* /etc/apt/sources.list.d/*

9. Run below commands to patch the server:

               cd /var/cache/apt/archives/

               sudo dpkg -i *.deb

               sudo apt-get install -f -y

 

10. After the patch, the Nessus scan showed clean:

 

Note:

Above steps were tested on Ubuntu Server 16.04.2 LTS. The other version of Ubuntu should be working the same way. But it is not guaranty.