Sneakernet Ubuntu Server Updates

After initially deploying an ubuntu server high side of an air gap (wikipedia), there will come a time when packages need to be added and/or updated. This article attempts to outline a process to build and keep up-to-date a private local repository.

In short, I will configure the packages on an internet-facing staging server, and copy the downloaded packages to the private server. The packages themselves contain enough data to build the private repository. I've adapted the procedure from Odzangba's How To. The main requirement for this to work is that you have access to a staging server on the low side, which will maintain an identical package configuration. This requirement wasn't bad for me, because a staging server is useful for a million other reasons. I run it in a virtual machine on my internet-facing development workstation. Either the low and high servers have to start in an identical configuration, or you have to be assured that /var/cache/apt/archives hasn't been cleared since they may have diverged. For the following procedure we'll assume the two servers are identical. You also need some medium of transferring data between the two hosts. This is where the term "sneakernet" originated. I'm lucky that I don't have to run floppies between two server rooms; thanks to the wonders of modern technology, all i have to do is shift a thumb drive from one USB hub to another. If you are going to be doing this frequently, I would suggest making the sneakernet step as quick and easy as possible.

Lastly, you will also need to get build-essentials. It is required to have this on the private server before you get started.

Just so there is no ambiguity, I'll refer to the private host as high and the internet-facing host as low. lowadmin is the user on the low side, and highadmin is the user on the high side. /home/highadmin/localrepo is the path to the repository on the high side, and this must be added to /etc/apt/sources.list. The only line the the sources.list file on my high server is

deb file:/home/highadmin/localrepo/ /

OK! So, assuming low and high have matching package configurations, this is how to add and/or update packages to the low side and sync those changes to the high side.

• The low and high servers are identical. I want to add and/or update packages, so I'll execute the following commands on the low host...
  

  sudo apt-get update 

  sudo apt-get upgrade

  and maybe...
  

  sudo apt-get install foobar spam

• Again, on the low host...
  

  rsync /var/cache/apt/archives/*.deb /media/thumbdrive

  I also like to add -vh (verbose, human-readable). Maybe rsync isn't necessary here, but I'm just in the habit of using it all the time. Also, my thumbdrive isn't usually passed directly to the virtual staging server, so my command looks more like this...
  

  rsync -vh /var/cache/apt/archives/*.deb lowadmin@devbox:/media/thumbdrive

• Sneakernet step. I move the thumbdrive two inches into another hub, and mount it on the high side server, then...
  

  rsync -vh /media/thumbdrive/*.deb /home/highadmin/localrepo/

  sudo dpkg-scanpackages /home/highadmin/localrepo/ /dev/null | gzip -9c > Packages.gz

  sudo apt-get update

  sudo apt-get upgrade

  This is where the magic happens. The second command uses dpkg-scanpackges to create the crucial Packages file. For further reference, see the man page.

That's it; the high side is now up-to-date.