I signed up for the Black IT Academy Linux Upskill Challenge. Twenty lessons, one server, a cohort in Slack, and a rule that you keep a public journal of what you did every day. Day 0 was today. The only goal was to have a server I could log into and to post a screenshot proving it.
That took about ten minutes. Then a purple box showed up in my terminal and I sat there for a while.
The setup
I went with a DigitalOcean droplet. Ubuntu 24.04, the cheapest Basic plan, [password / SSH key] for auth. The challenge guide says do not spend Day 0 comparing hosting providers, and after my AWS bill situation I did not need convincing. First thing I did after the droplet came up was set a $10 billing alert. That is a habit now.
Connected with ssh root@ and the IP. Said yes to the fingerprint prompt. Ran whoami and uptime and felt good about myself. Then I ran the standard sudo apt update && sudo apt upgrade -y because that is what you do on a fresh box.
The prompt
Halfway through the upgrade everything stopped and I got this:
A new version of configuration file /etc/ssh/sshd_config is available, but the version installed currently has been locally modified.
What do you want to do about modified configuration file sshd_config?
With a menu. Install the package maintainer's version. Keep the local version currently installed. Show the differences. A three way merge option.
My first reaction was confusion. Locally modified by who? I had owned this server for four minutes. I had not opened a single config file.
What was actually going on
sshd_config is the file that controls how the SSH server behaves. Which port it listens on, whether root can log in, whether passwords are allowed or only keys. It is the file that decides if you can get back into your own server.
The reason it was "locally modified" is that DigitalOcean modified it. When a droplet gets built, their provisioning process writes SSH settings into that file so you can log in the way you chose in their dashboard. From apt's point of view, that file no longer matches what the openssh package shipped, so when a new version of openssh came down in the upgrade, it stopped and asked me what to do.
That is not a bug. That is apt being careful. It will not silently overwrite a config file that someone changed on purpose.
Why the wrong answer is dangerous
If I had picked the maintainer's version, apt would have replaced the file with the stock Ubuntu default. The settings DigitalOcean put there to let me log in would be gone. Depending on what they set, that can mean password login is off and I never uploaded a key, or root login is blocked and I have no other user yet. The SSH session I was sitting in would keep working right up until I disconnected, and then I would be locked out of a server I had owned for four minutes.
Recovery is possible through the DigitalOcean web console, but that is a bad way to spend your first day.
What I did
I kept the local version. It was already highlighted, which I suspect is not an accident.
The part I did not know until I looked it up is that keeping local does not throw the new version away. apt drops the package's copy right next to yours, usually as /etc/ssh/sshd_config.dpkg-dist or .ucf-dist. So you lose nothing. You can run
diff /etc/ssh/sshd_config /etc/ssh/sshd_config.dpkg-dist
later and pull in anything that looks useful by hand, on your own schedule, with a plan for what happens if it breaks.
What I took away
The rule I wrote in my journal is simple. If that prompt appears on a machine I am SSH'd into, keep local, then diff. Never let a package manager rewrite the file that controls my access while I am relying on that access.
The bigger lesson is the same one the AWS audit taught me. The scary part of infrastructure is not the commands. It is the things that got set up for you that you did not know about. A provider edited a file on my behalf, and the first time I found out was when the system asked me to make a decision about it. The challenge apparently gets to hardening SSH in a later lesson. I am going to be reading that file very carefully when it does.
[Anything else that broke on Day 0, or cut this line.]
Server is alive. Screenshot is posted. Day 1 is Monday.
Top comments (0)