Back to lessons

Cybersecurity Triage

Risk: safe

Find Held Packages Blocking Patches

Patch simulation shows kept-back packages and you need to see whether apt holds are part of the reason.

Command

apt-mark showhold | sed 's/^/held: /'

Before you run this

Risk: safe. Do not remove holds automatically; confirm why each package was held and who owns the risk.

Expected output

Held package names prefixed with held: for quick review.

System impact

Nothing changes. apt-mark prints held package names and sed labels them for incident notes.

Recovery / rollback: no state is changed.

When to use it

Use before blaming repositories, mirrors, or dependency conflicts for missing security updates.

When not to use it

Do not remove holds automatically; confirm why each package was held and who owns the risk.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ apt-mark showhold

app-agent
linux-image-generic

$ apt-mark showhold | sed 's/^/held: /'

held: app-agent
held: linux-image-generic

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.

Lab setup steps

apt-mark showhold
apt-mark showhold | sed 's/^/held: /'

next steps

Related commands

Cybersecurity Triage Risk: safe

Review Kept-Back Packages Before Patching

Kept-back packages are where simple upgrade plans stop being simple.

apt-get -s upgrade | sed -n '/kept back:/,/^Inst/p'

Cybersecurity Triage Risk: safe

Find Services Needing Restart After Patches

A patched library does not protect a process still using the old one.

needrestart -b | sed -n 's/^NEEDRESTART-SVC: //p'

Cybersecurity Triage Risk: safe

Prove a Package Candidate Is From Security

The package name is not enough; the candidate repository tells the patch story.

apt-cache policy openssl | sed -n '/Installed:/p;/Candidate:/p;/security/p'

Cybersecurity Triage Risk: safe

Dry-Run Unattended Security Upgrades

Unattended upgrades can explain what they would patch before they patch it.

unattended-upgrade --dry-run --debug 2>&1 | sed -n '/Packages that will be upgraded:/,/^$/p'

Cybersecurity Triage Risk: safe

Check Whether Patches Require Reboot

Some security fixes are not complete until the host boots the new kernel or libraries.

test -f /var/run/reboot-required && printf 'reboot-required\n' && cat /var/run/reboot-required.pkgs

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.