Os Debian 11

Key Features

EOL Migration Priority

Security updates end June 2026. Systems running Bullseye after that date receive no patches. The primary concern is upgrade readiness.

Recommended upgrade path: Bullseye -> Bookworm -> Trixie (step-by-step, not skipping releases)

Key migration concerns:

• sources.list must be updated to bookworm before upgrade
• Held packages (apt-mark showhold) block dist-upgrade
• OpenSSL 1.1.1 -> 3.0 is a breaking change for compiled applications
• Python 3.9 -> 3.11 (Bookworm) -> 3.12 (Trixie) may break scripts
• AppArmor profile compatibility across major upgrades
• iptables-legacy to nftables transition

cgroups v2 Unified Hierarchy

Bullseye enabled cgroups v2 by default -- a prerequisite for modern container runtimes.

# Verify cgroup version
mount | grep cgroup
stat /sys/fs/cgroup/cgroup.controllers  # exists only on v2

# Force v2 if needed
# GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1"

yescrypt Password Hashing

Default PAM password hashing algorithm. Stronger against GPU-based attacks than sha512crypt. Hashes are forward-compatible; sha512crypt hashes remain valid.

OpenSSL 1.1.1 (Migration Concern)

Bullseye ships OpenSSL 1.1.1 (final 1.x LTS). Bookworm uses 3.0 with breaking changes:

• ENGINE API removed in 3.0
• Legacy algorithms require explicit provider loading
• Applications linked against libssl1.1 need recompilation

openssl version                      # should show 1.1.1
dpkg -l libssl1.1                    # check libssl1.1 presence
apt-cache rdepends libssl1.1         # packages depending on 1.1

Common Pitfalls

1. Delaying migration past June 2026 -- no security patches after EOL
2. Skipping Bookworm and upgrading directly to Trixie -- Debian does not support skipping releases
3. Not testing OpenSSL 3.0 compatibility before upgrade -- applications using ENGINE API will break
4. Ignoring held packages -- they silently block dist-upgrade
5. Forgetting to update third-party repo codenames -- repos pointing to "bullseye" will break after sources.list update
6. Running iptables-legacy rules -- Bookworm defaults to nftables; test firewall rules

Version Boundaries

• Kernel: 5.10 LTS
• Python: 3.9
• OpenSSL: 1.1.1
• systemd: 247
• cgroups v2: supported and default
• AppArmor: enabled by default
• Status: LTS -- EOL June 2026

Reference Files

Load for deep knowledge:

• ../references/architecture.md -- release process, package management
• ../references/diagnostics.md -- reportbug, apt diagnostics, debsecan
• ../references/best-practices.md -- release upgrade procedure, hardening