4 ms·

Seems to be in progress. In the future it will cover 'automatoc security updates'. Anyone have insight into wether this is a good idea and how it's done on some

Seems to be in progress. In the future it will cover 'automatoc security updates'. Anyone have insight into wether this is a good idea and how it's done on something as rolling as an ubuntu server?

crankylinuxuser 8y ago
--thanks hn:shocks for covering the debian side of things-- I know on centos, I put this in cron 2x a day: yum update-minimal --security && curl https://logserver/api/$(hostname)/$(needs-restarting https://logserver/api/$(hostname)/$(needs-restarting -r) It grabs all the security based updates, and installs only those. And it reports the reboot required status. I watch that and make a reboot ticket if it hits the true endpoint. Edit: the server part is just Node-red watching for those endpoint GETs. Once it sees a true, it fires a Jira ticket in the Change Management space for a security based reboot.
- mesofile 8y ago
  There is also a dedicated tool, yum-cron. Also, I thought the --security flag did not have any effect on CentOS?
  - emddudley 8y ago
    I believe you are right. The CentOS repos don't have the security metadata?
shocks 8y ago
On Ubuntu and Debian there is a package for this: unattended-upgrades. The default configuration should work fine for most.
- nomadluap 8y ago
  I've had problems on some servers where unattended-upgrades would install new kernel versions without removing the old ones, and ending up filling my /boot partition.
  - tempfs 8y ago
    sudo apt install byobu sudo purge-old-kernels
  - systematical 8y ago
    Ditto, for this reason I leave it off. Also, I want to be able to verify patches in staging. Kill me if you want, but we only patch once a month for this reason. For critical things like heartbleed, meltdown, spectre we fast track them obviously. I find it helpful to subscribe to all security lists of core services to know if something really nasty is out there.
  - dcbadacd 8y ago
    You can install Canonical livepatching, I think it deals with actually applying new kernels and removing old ones. https://www.ubuntu.com/livepatch https://www.ubuntu.com/livepatch

Seems to be in progress. In the future it will cover 'automatoc security updates'. Anyone have insight into wether this is a good idea and how it's done on something as rolling as an ubuntu server?

crankylinuxuser 8y ago

--thanks hn:shocks for covering the debian side of things-- I know on centos, I put this in cron 2x a day: yum update-minimal --security && curl https://logserver/api/$(hostname)/$(needs-restarting https://logserver/api/$(hostname)/$(needs-restarting -r) It grabs all the security based updates, and installs only those. And it reports the reboot required status. I watch that and make a reboot ticket if it hits the true endpoint. Edit: the server part is just Node-red watching for those endpoint GETs. Once it sees a true, it fires a Jira ticket in the Change Management space for a security based reboot.

mesofile 8y ago
There is also a dedicated tool, yum-cron. Also, I thought the --security flag did not have any effect on CentOS?
- emddudley 8y ago
  I believe you are right. The CentOS repos don't have the security metadata?

shocks 8y ago

On Ubuntu and Debian there is a package for this: unattended-upgrades. The default configuration should work fine for most.

nomadluap 8y ago
I've had problems on some servers where unattended-upgrades would install new kernel versions without removing the old ones, and ending up filling my /boot partition.
- tempfs 8y ago
  sudo apt install byobu sudo purge-old-kernels
- systematical 8y ago
  Ditto, for this reason I leave it off. Also, I want to be able to verify patches in staging. Kill me if you want, but we only patch once a month for this reason. For critical things like heartbleed, meltdown, spectre we fast track them obviously. I find it helpful to subscribe to all security lists of core services to know if something really nasty is out there.
- dcbadacd 8y ago
  You can install Canonical livepatching, I think it deals with actually applying new kernels and removing old ones. https://www.ubuntu.com/livepatch https://www.ubuntu.com/livepatch