Upgrading Debian 8 ("Jessie") to Debian 9 ("Stretch")

Category: Debian
Created: 2017-06-22
Updated: 2020-07-02

As of Debian 8, upgrading a Debian installation to the next major version number works quite smoothly. Depending on the speed of the server and the duration of the reboot, an upgrade is usually completed in under 15 minutes.

Always upgrade Debian Linux from one version to the next higher, do not skip versions!

To upgrade a server from Debian 8 to Debian 10, you must first upgrade from 8 to 9 and then from 9 to 10. Reboot the server after each upgrade!

Follow the steps below to upgrade:

update /etc/apt/sources.list (replace jessie with stretch)
if necessary, update the file /etc/apt/sources.list.d/liveconfig.list for the LiveConfig PHP repository in the same way
run apt update
run apt install apt dpkg
run apt upgrade
run apt full-upgrade. While running, you will be asked whether some existing configuration files should be replaced - in most cases it is better to keep the existing configuration (answer with no).
run apt-get autoremove to remove all packages that are no longer required
reboot the server (that’s important to switch the kernel and all kernel modules)
again run apt upgrade to complete the MariaDB setup if necessary (see section possible problems)
then log in to LiveConfig as admin and go to Server Management → E-Mail. Save the configuration for Postfix and for Dovecot again (this will update the configuration files and adapt them for Debian Stretch).

PHP 7

During an upgrade, PHP is not automatically updated to version 7. If you wish, do the following:

uninstall the “old” PHP 5: apt remove php5-cli php5-cgi php5-common
install the packages php-cli and php-cgi: apt install php-cli php-cgi
restart LiveConfig to detect the new PHP version: service liveconfig restart
log in to LiveConfig as admin and go to Server Management → Web. Save all active IP groups there again (i.e. open for editing and then click on the save button). This will update all vHost configurations and restart the PHP instances.

Possible problems

ProFTPD: on virtualized servers we have noticed that apt gets stuck during the upgrade of the ProFTPD package. Unfortunately, this cannot be canceled with ctrl + c. In this case open a second connection to the server via SSH, find the process using ps aux | grep frontend and interrupt it with an INT signal:
```
# ps aux | grep frontend
root     30473  0.0  0.8  64756 18304 pts/2    S+   13:24   0:00 /usr/bin/perl -w /usr/share/debconf/frontend /var/lib/dpkg/info/proftpd-basic.postinst configure 1.3.5-1.1+deb8u1
# kill -INT 30473
```

NGINX: if NGINX is managed by LiveConfig, an error message may appear during the upgrade:

Setting up nginx-full (1.10.3-1) ...
[FAIL] Upgrading binary: nginx failed!
invoke-rc.d: initscript nginx, action "upgrade" failed.
[FAIL] Restarting nginx: nginx failed!
invoke-rc.d: initscript nginx, action "restart" failed.
dpkg: error processing package nginx-full (--configure):
 subprocess installed post-installation script returned error exit status 1

Check whether the file /etc/nginx/nginx.conf contains a line with the instruction ssl_prefer_server_ciphers on;. If so, comment it out and then restart NGINX.
If errors still occur, check the file /var/log/nginx/error.log.

OpenDKIM: if the file /etc/default/opendkim is overwritten during the upgrade, it contains the setting RUNDIR=/var/run/opendkim. This is wrong and must be changed to RUNDIR=/var/spool/postfix/opendkim. You must then run the script /lib/opendkim/opendkim.service.generate so that the change is applied to the systemd configuration.
Dovecot: it may be that Dovecot doesn’t start because the file /etc/dovecot/dovecot.conf contains the instruction ssl_protocols = !SSLv2 !SSLv3. Save the Dovecot configuration again via LiveConfig (as described above), then you can start Dovecot again.

MariaDB: when upgrading to Debian 9, MySQL is replaced by MariaDB. The following error message may appear during the upgrade process:

Setting up mariadb-server-10.1 (10.1.23-9+deb9u1) ...
Job for mariadb.service failed because the control process exited with error code.
See "systemctl status mariadb.service" and "journalctl -xe" for details.
invoke-rc.d: initscript mysql, action "start" failed.
* mariadb.service - MariaDB database server
   Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/mariadb.service.d
       `-whatever.conf
   Active: failed (Result: exit-code) since Thu 2017-06-22 10:03:37 CEST; 14ms ago
  Process: 13896 ExecStart=/usr/sbin/mysqld $MYSQLD_OPTS $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION (code=exited, status=227/NO_NEW_PRIVILEGES)
  Process: 13804 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= ||   VAR=`/usr/bin/galera_recovery`; [ $? -eq 0 ]   && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited, status=0/SUCCESS)
  Process: 13801 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
  Process: 13798 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS)
 Main PID: 13896 (code=exited, status=227/NO_NEW_PRIVILEGES)

Jun 22 10:03:37 preview systemd[1]: Starting MariaDB database server...
Jun 22 10:03:37 preview systemd[13896]: mariadb.service: Failed at step NO_NEW_PRIVILEGES spawningâ¦gument
Jun 22 10:03:37 preview systemd[1]: mariadb.service: Main process exited, code=exited, status=227/â¦ILEGES
Jun 22 10:03:37 preview systemd[1]: Failed to start MariaDB database server.
Jun 22 10:03:37 preview systemd[1]: mariadb.service: Unit entered failed state.
Jun 22 10:03:37 preview systemd[1]: mariadb.service: Failed with result 'exit-code'.
Hint: Some lines were ellipsized, use -l to show in full.
dpkg: error processing package mariadb-server-10.1 (--configure):
 subprocess installed post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of default-mysql-server:
 default-mysql-server depends on mariadb-server-10.1; however:
  Package mariadb-server-10.1 is not configured yet.

dpkg: error processing package default-mysql-server (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of mysql-server:
 mysql-server depends on default-mysql-server; however:
  Package default-mysql-server is not configured yet.

dpkg: error processing package mysql-server (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 mariadb-server-10.1
 default-mysql-server
 mysql-server
E: Sub-process /usr/bin/dpkg returned an error code (1)

A common reason for this is that the server is still running with an old kernel version - the solution is to reboot the server (so that it runs with kernel 4.9.x from Debian Stretch) and then trigger the MariaDB installation again by running apt install mariadb-server-10.1. Don’t be surprised, this can take several minutes.