Ubuntu turns up in more small businesses than people expect: a reception PC that was rescued from the bin, a developer's laptop, a small file server in a cupboard, or a box running a point-of-sale or CCTV system. It's stable and secure — as long as it's kept up to date and backed up, like anything else.
This guide covers the essentials for keeping Ubuntu machines in good shape. The commands are run in a terminal (press Ctrl + Alt + T on Ubuntu desktop) and most need administrator rights via sudo.
1. Know which release you're on
Run:
lsb_release -a
Ubuntu releases come in two types. Long Term Support (LTS) releases arrive every two years and, according to Ubuntu's release cycle page, receive five years of standard security maintenance. Interim releases come out in between and have much shorter support. For office machines and servers, stick to LTS releases.
To see how much of the installed software is covered by security updates, run:
pro security-status
This shows which packages are in the main, supported part of the archive and which are not. For older LTS releases, Ubuntu Pro extends security maintenance further. Canonical offers Pro free for personal use on a small number of machines, with paid subscriptions for business; check the current terms on ubuntu.com/pro before relying on it.
If a machine is on a release that's out of standard support, plan an upgrade. On a desktop, Ubuntu will offer new LTS releases through Software Updater; on a server, the command is sudo do-release-upgrade. Take a backup and check it first.
2. Install updates manually
On any Ubuntu machine, the core update commands are:
sudo apt update
apt list --upgradable
sudo apt upgrade
apt update refreshes the list of available packages, apt list --upgradable shows what would change, and apt upgrade installs the updates. Ubuntu's own security suggestions recommend running updates regularly.
After upgrading, clean up packages that are no longer needed:
sudo apt autoremove
On Ubuntu desktop, the graphical equivalent is the Software Updater app, which checks for updates and installs them with a click.
3. Check whether a restart is needed
Some updates, particularly kernel updates, only take effect after a restart. Ubuntu creates a marker file when that's the case:
ls /var/run/reboot-required
If the file exists, a restart is waiting. To see which packages triggered it:
cat /var/run/reboot-required.pkgs
On a desktop, restart at a convenient moment. On a server, schedule it outside working hours.
4. Let security updates install themselves
Ubuntu applies security updates automatically using the unattended-upgrades package, which is installed by default. Ubuntu's documentation explains that, by default, it runs once a day.
It's worth confirming it's still switched on. The setting lives in /etc/apt/apt.conf.d/20auto-upgrades, which should contain:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
A value of 1 means daily; 0 means off. If the package is missing, install it with sudo apt install unattended-upgrades.
To see what it would do without changing anything:
sudo unattended-upgrade --dry-run --debug
And to check what it has done, look at its log:
less /var/log/unattended-upgrades/unattended-upgrades.log
The main options — such as whether to reboot automatically and which packages to exclude — are in /etc/apt/apt.conf.d/50unattended-upgrades. Automatic reboot is off by default. For a small server, it can make sense to turn it on with a set time outside working hours, using Unattended-Upgrade::Automatic-Reboot "true"; and Unattended-Upgrade::Automatic-Reboot-Time "02:00";.
On Ubuntu desktop, you can see the same choices in Software & Updates, on the Updates tab, under When there are security updates.
5. Don't forget snaps and firmware
Some software on Ubuntu, including Firefox on recent desktop releases, is installed as a snap rather than through apt. Snaps update themselves automatically in the background. To see what's installed and whether updates are waiting:
snap list
snap refresh --list
Hardware firmware can often be updated through the Linux Vendor Firmware Service:
fwupdmgr get-updates
On desktop, firmware updates may also appear in the Firmware Updater app. Only apply firmware updates with the machine plugged into mains power.
6. Keep the machine lean
Ubuntu's security suggestions recommend removing software you don't need and avoiding third-party repositories where possible, because every extra package is something else that needs patching. Note that adding a third-party repository doesn't automatically mean unattended-upgrades will update it — Ubuntu's documentation calls this out specifically — so any software from outside the Ubuntu archive needs its own update plan.
7. Back up — and test the restore
The NCSC's advice for any small organisation applies equally to Linux: back up the data your business needs, keep a copy separate from the machine, and make sure you can restore it.
On Ubuntu desktop, the Déjà Dup app — shown as Backups — is a straightforward option. If it isn't installed, get it from App Center or run sudo apt install deja-dup. Choose the folders to back up (usually your home folder), a storage location such as an external drive, network share or supported cloud storage, and turn on automatic backups. Set an encryption password, and keep that password somewhere safe; without it, the backup can't be restored.
To test it, open Backups, select Restore, browse to a file from an earlier backup date and restore it to a different folder, then open it.
On a small server, a simple approach is to copy important data to a separate disk or another machine on a schedule. For example:
rsync -av /srv/shared/ /mnt/backup/shared/
This copies new and changed files from /srv/shared to the backup disk. Test it by copying a file back from /mnt/backup/shared to a temporary folder and opening it. For anything business-critical, keep at least one copy off the machine and, ideally, off the premises.
A monthly checklist
sudo apt update && sudo apt upgrade— anything outstanding?ls /var/run/reboot-required— restart needed?- unattended-upgrades log — running daily?
pro security-status— still on a supported release?- Backup — recent, and one test restore done?
Where People's Digital fits
Our Business Care plan (£90/month) covers monthly checkups and backups and updates monitoring, so the machines that keep your business running — Linux, Windows or Mac — don't quietly fall behind. If you have an Ubuntu box nobody quite remembers setting up, contact us and we'll help you get it documented, patched and backed up.