4 ms·

Can I ask the following as this what Google did is literally what I try to achieve on a Raspberry Pi: I have configured unattended-upgrades (the package from a

Can I ask the following as this what Google did is literally what I try to achieve on a Raspberry Pi: I have configured unattended-upgrades (the package from apt) on a Raspberry Pi on Raspbian 10, but no security updates seem to ever be released. Is there a gotcha I’m missing resp. is there a better way of configuring an always-on computer and keep it secure?

pertbert 4y ago
The article mentions: > We build packages in package groups, to take into account separate packages that need to be upgraded together. Once the whole group has been built, we run a virtualized test suite to make sure none of our core components and developer workflows are broken. Each group is tested separately with a full system installation, boot and local test suite run on that version of the operating system. > We then proceed to carefully guide this release to the fleet utilizing SRE principles like incremental canarying and monitoring the fleet health.
StillBored 4y ago
Raspbian, or raspberry pi os? The latter is much closer to debian AFAIK, there is a 64-bit version/etc. But if your using it for server tasks, your probably better off actually running Debian. Although if your looking for something that is closer to a rolling release, you could just pick one of the distro's that have a release policy that strikes your fancy WRT how they roll out new packages/etc. Most distro's have rpi specific images, or you just install their generic arm64 images on top of something like the PFTF firmware. Put another way, raspberry pi os, has a fairly dated kernel/etc but works well with all the hardware on the machine for desktop purposes. If your using it as a server, its not a good choice because they frequently don't have useful things turned on (various filesystems, networking options, RAID levels, etc). The core storage/networking/cpu/etc type of things have been working quite well in mainline/etc for a couple years now, so that has trickled down into all these distros.
sillystuff 4y ago
It sounds like you missed a step. You need to create an apt conf file that runs unattended-upgrades (in addition to the configuration you already did in /etc/apt/apt.conf.d/50unattended-upgrades). There are a lot of options (see /usr/lib/apt/apt.systemd.daily for a description of options; the manpages are lacking), but just running: dpkg-reconfigure unattended-upgrades will create a minimal config file, '/etc/apt/apt.conf.d/20auto-upgrades' that may be all you need. But, you might consider adding something like below to cleanup downloaded package files: // Auto cleanup archives APT::Periodic::MaxAge "10"; // Setting minage too is a good idea to prevent race conditions APT::Periodic::MinAge "8"; Or, if you prefer (but, this will delete all archives present when it triggers and not just old ones like above): APT::Periodic::AutocleanInterval "10"; (Note: I'm assuming Raspbian is the same as the upstream Debian; I've never used Raspbian)

pertbert 4y ago

The article mentions: > We build packages in package groups, to take into account separate packages that need to be upgraded together. Once the whole group has been built, we run a virtualized test suite to make sure none of our core components and developer workflows are broken. Each group is tested separately with a full system installation, boot and local test suite run on that version of the operating system. > We then proceed to carefully guide this release to the fleet utilizing SRE principles like incremental canarying and monitoring the fleet health.

StillBored 4y ago

Raspbian, or raspberry pi os? The latter is much closer to debian AFAIK, there is a 64-bit version/etc. But if your using it for server tasks, your probably better off actually running Debian. Although if your looking for something that is closer to a rolling release, you could just pick one of the distro's that have a release policy that strikes your fancy WRT how they roll out new packages/etc. Most distro's have rpi specific images, or you just install their generic arm64 images on top of something like the PFTF firmware. Put another way, raspberry pi os, has a fairly dated kernel/etc but works well with all the hardware on the machine for desktop purposes. If your using it as a server, its not a good choice because they frequently don't have useful things turned on (various filesystems, networking options, RAID levels, etc). The core storage/networking/cpu/etc type of things have been working quite well in mainline/etc for a couple years now, so that has trickled down into all these distros.

sillystuff 4y ago

It sounds like you missed a step. You need to create an apt conf file that runs unattended-upgrades (in addition to the configuration you already did in /etc/apt/apt.conf.d/50unattended-upgrades). There are a lot of options (see /usr/lib/apt/apt.systemd.daily for a description of options; the manpages are lacking), but just running: dpkg-reconfigure unattended-upgrades will create a minimal config file, '/etc/apt/apt.conf.d/20auto-upgrades' that may be all you need. But, you might consider adding something like below to cleanup downloaded package files: // Auto cleanup archives APT::Periodic::MaxAge "10"; // Setting minage too is a good idea to prevent race conditions APT::Periodic::MinAge "8"; Or, if you prefer (but, this will delete all archives present when it triggers and not just old ones like above): APT::Periodic::AutocleanInterval "10"; (Note: I'm assuming Raspbian is the same as the upstream Debian; I've never used Raspbian)