I feel obliged to briefly discuss the use of Debian packages in contrast to just pulling software from their website and installing it. Why is this important? Well…
“The roundcube software in this guide is totally outdated. Just go to roundcube.net and download a new version.”(Frequent advice in the user comments of these guides.)
…or an even less friendly quote…
“I wish I could convince Debian maintainers to stop providing Rspamd in Debian repos. Probably, I should change a license for that, but I’m really tired of that crap…”Vsevolod Stakhov – principal developer of rspamd
So what’s the deal? Shouldn’t we just use Debian packages where we find it comfortable and install any other software in a newer version? Sure, nobody keeps you from doing that. Consider these aspects though…
Advantage: cool new software
That advantage is pretty obvious. Why use the old dusty Roundcube version that comes with Debian Buster if you can get the sexy shiny new version directly from roundcube.net? It’s just a tarball that can be extracted somewhere and works easily. Some software even comes in handy APT repositories so it’s simple.
Disadvantage: conflicts with the APT package system
Debian arguably has the best software package management of all operating systems. It keeps track of all files that are installed on your disk. And it knows how to upgrade to newer versions without damaging your configuration.
There are defined locations on your disk (according to the FHS) like /opt or /usr/local where additional software can live. That is certainly true but then you need to make sure that you do not have the same APT package installed, too. Otherwise you would have to specify exactly which copy of the software you want to use. This can lead to annoying mixups.
Disadvantage: conflicts with other packages
Debian package maintainers take great care that packages in a stable Debian distribution work well together. Dovecot in Debian Buster comes with helpful instructions on how to use the Postfix version in Debian Buster. If you take packages from other sources then you may find that they use unusual paths in your file system. Or that they somehow do not work with the “old” version of other packages that you installed from the Debian sources. This can quickly lead to an update frenzy where you need to update several unrelated packages that in turn break other packages.
Disadvantage: no automatic integration
Debian packages are not just a different format of the original (“upstream”) software tarball. Debian developers make sure that every part of the software gets into the right spot. For example configuration data always ends up somewhere in /etc. Also it integrates nicely with other parts. Debian’s Roundcube package offers working configuration snippets that plug into your Apache web server. If you install the software on your own you will lack that.
Disadvantage: no security support
Especially in public-facing services like mail servers this is my most important issue. Surely you can install the newest version of Roundcube. But as a responsible system administrator you will need to make sure that you check for updates every day and install them when they pop up. Debian packages get updates automatically. Your manual installation will not.
And that is no matter of paranoid phantasy. I have lost several systems in my life because the update mechanism failed and script kiddies found open security issues and did bad things on my servers.
And I have also broken my servers because I gave in to the temptation to use newer software. Some developers provide their own APT repositories and actively discourage you to use the packages provided by Debian. In fact I was literally shocked to read that the rspamd principal developer Vsevolod Stakhov not only discourages but even threatens Debian users if they dare using Debian packages. He even considers changing his license to exclude Debian from using his software. Of course bug reports of Debian packages should be sent to the Debian project first. However developers must not force users to ignore basic principles of Debian. In fact this is the most unprofessional behavior of an open source developer I have seen in the last years. Yikes.
That aside, developers hardly ever fix issues in old software. That’s just not fun. Developers like to go forward. While they implement new features they also fix issues on their way. I totally understand that motivation. But that way they force users to accept their changes and new features even if the users just want to fix the security issues.
So that way you are forced to upgrade. In Debian’s security updates you will get patches for the existing software version. If you installed version 1.3.8 then you will stay on version 1.3.8 – just with security fixes applied. You can rely on your system that your configuration will work throughout the entire lifetime of that Debian release. However if you installed version 1.4.x manually then you will have to use every new version that the author publishes. Security issues are then fixed by updating. And if that changes the configuration or the general UI then you and your users will have to deal with that. Or you just ignore further updates and are likely to find your server part of a botnet that keeps computing Bitcoins.
So be aware that when you manage software yourself you will have to check for updates. And expect broken servers.
The meaning of ‘stable’
However let me get one term straight: “stable”. Some consider software versions that are included in a stable distribution more reliable than those that get updated frequently. Unfortunately that is often just wrong. Think of stable as long-lasting. That version will stay on your system and even security updates will change as little as possible to prevent surprises. Please do not mistake it for a warrant to get you more secure software. Unfortunately there are software packages in Debian that have not been updated in years and have been suffering from security issues for a year. (Yes, I mean you, solr.) Even the rspamd package in Debian Buster is a bit buggy and need manual fixing (as explained in this guide). Still if you are a busy system administrator and have to puppeteer a hundred servers then you will want to stay with stable because it makes your life easier. And if you got something running it will keep running until the next stable release.
Throughout this guide I will always make you install Debian packages. Also please expect better support through the comments sections if you stay on the trail of what is good and righteous. 🙂
For more information see also the Debian FAQ on security.
Oh, and Roundcube was just a random example. There’s nothing wrong with Roundcube. 🙂