3 ms·

Have you ever wondered why "VPS (and cloud) servers" don't do the "sudo apt-get update && sudo apt-get upgrade && sudo reboot" automatically? Anyways, if those

Have you ever wondered why "VPS (and cloud) servers" don't do the "sudo apt-get update && sudo apt-get upgrade && sudo reboot" automatically? Anyways, if those Yuno people are smart enough, they do this once a day automatically via CRON. And if their systems are expensive enough, they consist of 2 redundant engines. I mean just think of a file server. Everybody can tell you how much of a security nightmare an FTP server is. Why? Probably because the ftp daemons are so complex and have so many options. So people turned to Dropbox and other expensive but simple solutions.

Morgawr 12y ago
I wouldn't like to perform update && upgrade (and also reboot!) automatically every day or so. Why? Because updates/upgrades are always something that should be overseen by a capable administrator. Sometimes updates break, sometimes they override your personal config files with less secure default files, sometimes the system crashes and you're left in an inconsistent and dangerous state, etc etc. I definitely don't want to automate my server's updates in such a way.
- azernik 12y ago
  I haven't looked too closely at this particular project, but if I were writing something similar, I'd explicitly make it hard to access any of the security-related settings, and make the defaults (for which upgrades are tested) secure by default. In this case, changes to security settings to deal with new threats would be distributed through the package update mechanism, not overridden by it. That is, the really interesting target user here is not the one who will drop into the command line to tweak /etc/ssh/sshd_config and then get annoyed when their changes are overwritten on the next update.
- blablabla123 12y ago
  If you allow little configuration options, you could as well allow to easily reset the server to default. I mean a zero configuration server cannot be compared to a server that has > 100 users. The latter usually has a lot of custom settings which would a) easily get damaged during updated b) be lost when resetting the whole thing There is definitely a need for easily manageable servers that should be low on customization and maintenance.
_delirium 12y ago
Ubuntu has a package 'unattended-upgrades' that will automatically pull and apply many kinds of updates.

Morgawr 12y ago

I wouldn't like to perform update && upgrade (and also reboot!) automatically every day or so. Why? Because updates/upgrades are always something that should be overseen by a capable administrator. Sometimes updates break, sometimes they override your personal config files with less secure default files, sometimes the system crashes and you're left in an inconsistent and dangerous state, etc etc. I definitely don't want to automate my server's updates in such a way.

azernik 12y ago
I haven't looked too closely at this particular project, but if I were writing something similar, I'd explicitly make it hard to access any of the security-related settings, and make the defaults (for which upgrades are tested) secure by default. In this case, changes to security settings to deal with new threats would be distributed through the package update mechanism, not overridden by it. That is, the really interesting target user here is not the one who will drop into the command line to tweak /etc/ssh/sshd_config and then get annoyed when their changes are overwritten on the next update.
blablabla123 12y ago
If you allow little configuration options, you could as well allow to easily reset the server to default. I mean a zero configuration server cannot be compared to a server that has > 100 users. The latter usually has a lot of custom settings which would a) easily get damaged during updated b) be lost when resetting the whole thing There is definitely a need for easily manageable servers that should be low on customization and maintenance.

_delirium 12y ago

Ubuntu has a package 'unattended-upgrades' that will automatically pull and apply many kinds of updates.