The Problem: Why is your system still not secure after an apt upgrade?
When I first switched from CentOS to Ubuntu, I learned a hard lesson. Even though I ran sudo <a href="https://itfromzero.com/en/ubuntu-en/installing-and-using-nala-on-ubuntu-a-package-manager-with-a-clean-interface-parallel-downloads-and-better-performance-than-apt.html">apt upgrade</a> regularly and the system reported successful updates for critical security packages like OpenSSL or libc, a closer check with the lsof command revealed that Nginx and PHP-FPM processes were still loading old libraries from RAM.
Essentially, the files on the disk were new, but the code running in memory was still the old, vulnerable version. The most “brute force” solution is to reboot the entire server. However, for production systems requiring 99.99% uptime, restarting a server for a small patch is a luxury. That’s why needrestart exists. It helps you pinpoint exactly which services need to be “refreshed” without disrupting the whole system.
Installation and Usage in 30 Seconds
On modern Ubuntu Server versions (from 20.04 onwards), needrestart is often pre-installed. If your server doesn’t have it, installation only takes up about 10MB of disk space.
1. Quick Installation
sudo apt update && sudo apt install needrestart -y2. Manual Check
To scan for any “remnants” running in RAM, use the command:
sudo needrestartIf the system is clean, you’ll get a witty message: “Your power is great. I mean… everything is up to date.”. Otherwise, an ncurses interface will appear, listing the services using old libraries so you can choose to restart them immediately.
How It Works: Why Is It So Smart?
When you update a .so (shared object) file, APT overwrites the file on the disk. However, running processes still hold a “handle” pointing to the memory area containing the old file content. needrestart scans the /proc directory to find memory mappings pointing to files marked as ‘deleted’.
This tool focuses on 4 main tasks:
- Library check: Scans for processes loading outdated libraries.
- Kernel check: Compares the running Kernel version (via
uname -r) with the latest installed version. - Microcode check: Checks if the CPU needs new microcode to patch vulnerabilities like Spectre or Meltdown.
- APT Hook: Automatically triggers a reminder every time an
apt upgradecommand finishes.
Configuration for Production Environments
By default, needrestart will interrupt the update process to ask for user input via a blue screen (interactive). This is quite annoying if you are running automated scripts or using Ansible.
Adjust the configuration file at:
sudo nano /etc/needrestart/needrestart.confCustomizing the Restart Mode
Find the $nrconf{restart} parameter and choose one of three values:
'i'(interactive): Asks via the interface (default).'a'(automatic): Automatically restarts. Warning: May cause sudden service disruptions.'l'(list only): Only logs and lists, does nothing. This is the safest choice for critical servers.
Blacklisting Sensitive Services
If you don’t want needrestart to touch databases (like MySQL or PostgreSQL) for fear of data corruption during a sudden shutdown, you can configure it to ignore them:
$nrconf{override_rc} = {
qr(^mysql) => 0,
qr(^postgresql) => 0,
};Real-world Experience from the Field
Don’t Ignore Kernel Warnings
Unlike application libraries, the Kernel cannot be restarted partially. If needrestart indicates a Kernel reboot is needed, plan for maintenance soon. Kernel patches often address root access vulnerabilities or container escapes.
Leveraging Batch Mode for Automation
If you manage dozens of servers, you can’t manually monitor every screen. Use the -b flag for machine-readable output:
sudo needrestart -bCombined with grep, you can write a small script to send notifications via Telegram whenever a server needs attention.
Notes on Docker and Containers
A minor downside is that needrestart sometimes mistakenly scans processes running inside Docker containers if run directly on the Host. For Docker, the golden rule remains: Rebuild the new Image -> Pull -> Restart Container. Don’t try to use needrestart to restart services inside a running container.
Conclusion
needrestart is a powerful ally that helps you manage Ubuntu more professionally. It removes the guesswork and lets you know exactly when action is required. For me, it’s a “must-have” tool immediately after OS installation to ensure all security patches actually take effect rather than just sitting on the hard drive.
