Package Management and Software Installation

What Is a Package Manager?

A package manager is a tool that automates downloading, installing, updating, and removing software on a Linux system. Instead of hunting for installer files manually, you run a single command and the package manager fetches the correct software, checks its authenticity, and resolves any dependencies it needs. In a data center, this consistency is essential: every server must be configured in a known, repeatable state.

Two package managers dominate enterprise Linux:

• apt (Advanced Package Tool) — used on Debian-based distributions such as Ubuntu Server.
• dnf (Dandified YUM) — used on Red Hat–based distributions such as RHEL, AlmaLinux, and Rocky Linux.

Both tools perform the same core tasks; the commands differ in syntax.

Repositories: Where Software Comes From

A repository (repo) is a curated, server-hosted collection of software packages. When you run an install command, the package manager contacts the configured repos, downloads the package, and verifies it before installing. Repos can be hosted publicly by the distribution vendor, by third parties, or internally by your organization.

In a production data center, only approved repositories should be enabled. Unapproved repos introduce two serious risks:

1. Security risk — A malicious or compromised package can open backdoors, exfiltrate data, or disrupt services. This is a supply-chain security concern addressed by standards bodies and change-management policies.

2. Stability risk — Packages from unknown sources may conflict with existing software, break dependencies, or introduce untested behavior on production hardware.

Always follow your organization's change-management policy before adding any new repository. Document every change in your lab log and, in production, in the approved ticketing system.

Core apt Commands (Debian/Ubuntu)

| Task | Command |

|---|---|

| Update repo metadata | `sudo apt update` |

| Install a package | `sudo apt install <package>` |

| Remove a package | `sudo apt remove <package>` |

| Search for a package | `apt search <keyword>` |

| List installed packages | `apt list --installed` |

| Upgrade all packages | `sudo apt upgrade` |

Always run `sudo apt update` before installing to make sure you are working with current metadata.

Core dnf Commands (RHEL/AlmaLinux)

| Task | Command |

|---|---|

| Update repo metadata and packages | `sudo dnf check-update` |

| Install a package | `sudo dnf install <package>` |

| Remove a package | `sudo dnf remove <package>` |

| Search for a package | `dnf search <keyword>` |

| List installed packages | `dnf list installed` |

| Upgrade all packages | `sudo dnf upgrade` |

Verifying Package Integrity

Both apt and dnf verify packages using cryptographic signatures before installation. The distribution maintainer signs each package with a GPG key; the package manager checks that signature against a trusted keyring. If the signature does not match, the installation is refused. You can also verify an already-installed package's files using:

• apt: `dpkg -V <package>` — checks installed files against the package database.
• dnf/rpm: `rpm -V <package>` — reports any files that differ from the installed package record.

Never bypass signature checks. A failed verification is a red flag for a tampered or corrupted package.

Adding Repositories Safely

Ubuntu — PPA (Personal Package Archive): `sudo add-apt-repository ppa:<publisher>/<ppa-name>` followed by `sudo apt update`. Only add PPAs that appear in your organization's approved list.

AlmaLinux — EPEL (Extra Packages for Enterprise Linux): `sudo dnf install epel-release`. EPEL is maintained by the Fedora community and is widely accepted in enterprise environments, but must still be approved by your change-management process before being enabled on production systems.

After adding a repo, document the repo URL, the date, the ticket number, and the reason in your lab log.

Repository Policy and Change Management

Data centers operate under strict change-management policies. Before any software change on a production server, a change request is submitted, reviewed, and approved. Package installation is a change. Adding a repository is a larger change because it affects every future install. Violating repository policy can:

• Expose the organization to a supply-chain attack (malware hidden in a dependency).
• Cause configuration drift, where servers diverge from their documented baseline.
• Violate compliance frameworks (such as those required in regulated industries).

In the lab, treat the mock policy document as you would a real one. Read it, follow it, and answer the worksheet questions thoughtfully.

Safety Notes

This lesson involves only software commands; there is no electrical or physical hazard at the keyboard. However, running commands with `sudo` grants elevated privileges. A mistyped remove command can delete critical system packages. Before pressing Enter:

• Read the command output or confirmation prompt carefully.
• Never copy-paste commands from untrusted web sources into a root or sudo session.
• On a production system, always work under an approved change ticket.

These habits protect both the system and your career.