13 ms·

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for not

by jewel 12y ago

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dreaming of making a system to help debian users create and manage a local set of packages, but haven't really had a chance to take it to a point where it'd be helpful in this scenario. My extended thoughts on the matter: http://stevenjewel.com/2013/10/hacking-open-source/ http://stevenjewel.com/2013/10/hacking-open-source/

namidark 12y ago
Shameless plug as the owner: https://sysward.com/ https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!
- daddykotex 12y ago
  I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!
  - nacs 12y ago
    No warnings about SSL on iPhone Safari. Are you on Android? (Disclaimer: not affiliated with Sysward)
  - daddykotex 12y ago
    https://www.dropbox.com/s/spigppz2hmya5ch/Screenshot_2014-09-24-23-47-48.png?dl=0 https://www.dropbox.com/s/spigppz2hmya5ch/Screenshot_2014-09...
  - namidark 12y ago
    Thanks for the heads up - I'll take a look!
    - cookiecaper 12y ago
      If you use one of several popular cheap SSL providers, you need to add some intermediate certs to your server's SSL store or Android will show those warnings. It's pretty lame. https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=AR1549 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
vhost- 12y ago
I typically use the CVE RSS feeds http://nvd.nist.gov/download/nvd-rss.xml http://nvd.nist.gov/download/nvd-rss.xml and plug them into an IRC bot.
- Soliah 12y ago
  Great idea. Setup IFTTT to do the same to a Slack channel: https://ifttt.com/recipes/206224-post-nvd-vulnerability-notifications-to-slack https://ifttt.com/recipes/206224-post-nvd-vulnerability-noti...
  - finnn 12y ago
    Doesn't slack have it's own RSS bot? Why not use that?
    - Soliah 12y ago
      Ah cool didn't know Slack had RSS integration.
nodesocket 12y ago
Plug: While we don't support alerts of security incidents, you can use https://commando.io https://commando.io to easily execute yum -y update bash or apt-get upgrade -y bash on groups of servers. We also integrate with DigitalOcean, AWS, and Rackspace. See the following tweet: https://twitter.com/alexandermensa/status/514811145887027201 https://twitter.com/alexandermensa/status/514811145887027201
tribaal 12y ago
Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.
- merb 12y ago
  When Landscape would be cheaper I would try to using it aswell, but since it's not I'm using ansible.
- zaroth 12y ago
  How much does Landscape cost? I honestly can't figure it out. The only thing I saw was ~$300 per server... most of my servers didn't cost anywhere near $300...
  - reedloden 12y ago
    You can't buy Landscape directly, sadly... You have to pay for Ubuntu Advantage, which is their support offering, which is why it's a ridiculous $$$ per server.
- reedloden 12y ago
  I have no interest in paying for Ubuntu Advantage. I would happily pay a reasonable amount for just Landscape, but Canonical doesn't offer that. Get your sales guys to fix that, and you'll end up with a lot more Landscape users. Or better yet, just open source Landscape.
  - noir_lord 12y ago
    I would also be interested in a landscape only package at a reasonable price.
    - Karunamon 12y ago
      +1. Landscape has gotten zero serious evaluation at our company completely because of their heavy-handed pricing arrangement.
jacksoncage 12y ago
Using salt to push out updates, easy and fast. "salt * pkg.install bash refresh=True"
rlpb 12y ago
On Debian or Ubuntu, install the unattended-upgrades package. Configure it to install security updates only. > ...but the distribution hasn't made a package yet. On Ubuntu, I think you can probably set up a Launchpad PPA and then configure unattended-upgrades to automatically pull from it. Then just push what you need to that PPA when you're ready. If you want to host the repository elsewhere, then that's possible too, but you probably want to start with a PPA since you don't have to worry about build and publishing infrastructure to start off with.
- scott_karana 12y ago
  For anyone who doesn't know, there's also a similar "yum-updatesd" for RHEL and derivatives like CentOS, though it only gives notifications of updates IIRC.

by jewel 12y ago

namidark 12y ago

Shameless plug as the owner: https://sysward.com/ https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!

daddykotex 12y ago
I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!
- nacs 12y ago
  No warnings about SSL on iPhone Safari. Are you on Android? (Disclaimer: not affiliated with Sysward)
- daddykotex 12y ago
  https://www.dropbox.com/s/spigppz2hmya5ch/Screenshot_2014-09-24-23-47-48.png?dl=0 https://www.dropbox.com/s/spigppz2hmya5ch/Screenshot_2014-09...
- namidark 12y ago
  Thanks for the heads up - I'll take a look!
  - cookiecaper 12y ago
    If you use one of several popular cheap SSL providers, you need to add some intermediate certs to your server's SSL store or Android will show those warnings. It's pretty lame. https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=AR1549 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...

vhost- 12y ago

I typically use the CVE RSS feeds http://nvd.nist.gov/download/nvd-rss.xml http://nvd.nist.gov/download/nvd-rss.xml and plug them into an IRC bot.

Soliah 12y ago
Great idea. Setup IFTTT to do the same to a Slack channel: https://ifttt.com/recipes/206224-post-nvd-vulnerability-notifications-to-slack https://ifttt.com/recipes/206224-post-nvd-vulnerability-noti...
- finnn 12y ago
  Doesn't slack have it's own RSS bot? Why not use that?
  - Soliah 12y ago
    Ah cool didn't know Slack had RSS integration.

nodesocket 12y ago

Plug: While we don't support alerts of security incidents, you can use https://commando.io https://commando.io to easily execute yum -y update bash or apt-get upgrade -y bash on groups of servers. We also integrate with DigitalOcean, AWS, and Rackspace. See the following tweet: https://twitter.com/alexandermensa/status/514811145887027201 https://twitter.com/alexandermensa/status/514811145887027201

tribaal 12y ago

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.

merb 12y ago
When Landscape would be cheaper I would try to using it aswell, but since it's not I'm using ansible.
zaroth 12y ago
How much does Landscape cost? I honestly can't figure it out. The only thing I saw was ~$300 per server... most of my servers didn't cost anywhere near $300...
- reedloden 12y ago
  You can't buy Landscape directly, sadly... You have to pay for Ubuntu Advantage, which is their support offering, which is why it's a ridiculous $$$ per server.
reedloden 12y ago
I have no interest in paying for Ubuntu Advantage. I would happily pay a reasonable amount for just Landscape, but Canonical doesn't offer that. Get your sales guys to fix that, and you'll end up with a lot more Landscape users. Or better yet, just open source Landscape.
- noir_lord 12y ago
  I would also be interested in a landscape only package at a reasonable price.
  - Karunamon 12y ago
    +1. Landscape has gotten zero serious evaluation at our company completely because of their heavy-handed pricing arrangement.

jacksoncage 12y ago

Using salt to push out updates, easy and fast. "salt * pkg.install bash refresh=True"

rlpb 12y ago

On Debian or Ubuntu, install the unattended-upgrades package. Configure it to install security updates only. > ...but the distribution hasn't made a package yet. On Ubuntu, I think you can probably set up a Launchpad PPA and then configure unattended-upgrades to automatically pull from it. Then just push what you need to that PPA when you're ready. If you want to host the repository elsewhere, then that's possible too, but you probably want to start with a PPA since you don't have to worry about build and publishing infrastructure to start off with.

scott_karana 12y ago
For anyone who doesn't know, there's also a similar "yum-updatesd" for RHEL and derivatives like CentOS, though it only gives notifications of updates IIRC.