keepalived

keepalived moves virtual IPs between servers with VRRP and health-checks the real servers behind Linux Virtual Server (IPVS) load balancing. Current releases, with the 2.4 security fixes and HMAC-authenticated VRRP. One release line for Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04 on amd64 and arm64.

latest 2.4.3www.keepalived.org upstream source packaging

Componentmain

follows every upstream release, minors and majors included. Currently 2.4.3.

Release line

Deliver to

keepalived 1:2.4.3-1+freshdeb~deb13

1Trust the signing key (once per machine)

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.freshdeb.com/freshdeb-archive-keyring.gpg \
  | sudo tee /etc/apt/keyrings/freshdeb-archive-keyring.gpg >/dev/null

Fingerprint 3BBD F03A 9C0B F890 F8CA 9510 7595 CC55 468F 3161. How to verify.

2Add the source

sudo tee /etc/apt/sources.list.d/freshdeb-keepalived.sources >/dev/null <<EOF
Types: deb
URIs: https://deb.freshdeb.com/keepalived
Suites: $(. /etc/os-release && echo $VERSION_CODENAME)
Components: main
Signed-By: /etc/apt/keyrings/freshdeb-archive-keyring.gpg
EOF

With auto, the shell reads the codename from /etc/os-release on the machine you paste this into.

3Install

sudo apt update && sudo apt install keepalived
apt policy keepalived   # expect 1:2.4.3-1+freshdeb~…

Before you upgrade from the distribution's keepalived

The freshdeb version sorts higher, so apt upgrade moves you over in place. Configurations keep working. Since 2.4.0, keepalived checks the target of symlinked notify scripts and the notify FIFO and runs them in a hardened environment, and denies its DBus methods by default. The package's NEWS entry, shown by apt-listchanges, has the details.

keepalived 1:2.4.3-1+freshdeb~deb13

Compared with Debian's package

Debian's packaging decides where things go: package names, paths, users, services and how upgrades behave. The build follows upstream's own release builds wherever Debian's differs.

Build: Debian's packaging, unchanged. It patches nothing upstream and builds with SNMP, DBus, JSON, BFD, regex, nftables and systemd support.
Source: keepalived.org's release tarball, as Debian builds it, pinned by sha256 (upstream lists only MD5 sums).
Layout: Debian's: /etc/keepalived/keepalived.conf, /etc/default/keepalived, its systemd unit and init script, and Debian's epoch (1:).
auth_hmac: HMAC-SHA256 authenticated VRRP adverts, new in 2.4.0 and recommended for unicast. Its signed format changed in 2.4.2, so every node of a virtual router that uses it must run the same version.

Packing list

Every release line of keepalived and the distributions it's built for. Each line is its own APT component and only gets the releases it follows (main: every upstream release, minors and majors included). After upstream end of life it stops building but stays installable. Hatched cells have no build: usually that distribution already ships the same or a newer version itself.

Line	Component	Current	bookwormDebian 12	trixieDebian 13	jammyUbuntu 22.04	nobleUbuntu 24.04	resoluteUbuntu 26.04	Support
main	main	2.4.3	built: 1:2.4.3-1	built: 1:2.4.3-1	built: 1:2.4.3-1	built: 1:2.4.3-1	built: 1:2.4.3-1	–

Versions follow <upstream>-<revision>+freshdeb~<distro>, distro being deb12, deb13, ubuntu22.04, ubuntu24.04 or ubuntu26.04, for amd64 and arm64. Published versions are never rebuilt or replaced.

keepalived: The daemon, with genhash for checking HTTP health check digests.

Origin

Upstream: github.com/acassen/keepalivedrelease tags pinned to commit hashes, built from the checksummed release tarball
Debian packaging: salsa.debian.org/debian/pkg-keepalivedimported unmodified at 94681b5 (1:2.3.4-1, unstable)
Our changes: overlays under overlays/ for bookworm, trixie, jammy, noble, resolute.
Built for: bookworm, trixie, jammy, noble, resoluteamd64, arm64, built natively
Notes: packaging notes · package.yaml · report an issue

Also in Networking

All 23 packages