3

I recently moved from Windows Server administration to Linux administration. In Windows I get used to practice that all critical and security updates are installed ASAP on their release. On Windows this can be done via few buttons with help of WSUS and SCCM.

When I moved to Linux I am very surprised that I see a 3rd Senior Linux administrator who does not care about updates at all. When I tried to find some central point of checking if my system is secure or not, like WSUS and SCCM - I couldn't find it.

What are best practices of ensuring that my Linux system is up to date and secure? What about 3rd party software installed on this system? How can I check that it's also secure?

  • I don't know if you've done some mild perusing of the googles, but here is a link that gives a general overview on keeping Ubuntu Linux servers up to date cyberciti.biz/faq/how-do-i-update-ubuntu-linux-softwares . What distro are you running? – INV3NT3D Aug 16 '16 at 13:22
  • probably (depending on distro) the commands: sudo apt-get update and sudo apt-get dist-upgrade would be what you would want. – N. Greene Aug 16 '16 at 13:24
  • @N.Greene dist-upgrade is something you don't want to run in a server unless you really want to. For example, a dist-upgrade would upgrade the kernel or libc, and that often may lead to problems in a server. – yzT Aug 16 '16 at 13:40
  • @Ay0 considering that OP seemed to know 0% about Linux updates, and possibly since where he's at they don't care about updates, willing to bet there are some kernel updates needed if "I see a 3rd Senior Linux Administrator who does not care about updates at atll" – N. Greene Aug 16 '16 at 14:22
6

Your problem here is that you are looking at Linux management as it was Windows management.

In Linux, all distros have repositories of packages that handle the versions of the software available to that specific distro. You can look at these repositories as a WSUS, but it's not something that you manage but someone else does.

Depending of the package manager the distro uses, you have different ways of staying up to date. Odds are that you are either using a Debian-based, a RedHat-based distro or OpenSUSE/SUSE, so the commands are:

  • apt-get update && apt-get upgrade for Debian.
  • yum update for RedHat.
  • zipper update for OpenSUSE and SUSE.

If by similar to WSUS you mean for local central updates, you can mirror the repositories of the distro you are using and set it up. For example, in this link you have info for RedHat.

PS: never run the upgrade variants of the commands above unless you really want to. Upgrade will update important things of the core of the server that you may not be ready to handle, like kernel, important libs, etc.

  • I think now my question can be narrowed to - "how do I get instant notifications about discovered security bugs in official Linux distributions or 3rd party software?" – Link08 Aug 16 '16 at 14:16
  • 1
    @Link08 that's not narrowing it, that's a different question at all :D Usually the go-to option is what drewbenn said, subscribe to mailing lists. There are many about this topic. – yzT Aug 16 '16 at 16:28
  • 1
    To slightly extend on this correct answer, most distributions provide a mechanism of selecting what updates you subscribe to. By default, most distributions with periodic releases will only provide security updates in between releases, and require explicit consent to switch to the next release which includes feature changes. Some distros sometimes backport important feature updates, so one must opt-out of it to avoid it, if need be. The mechanisms depend on the distro. – Steve Dodier-Lazaro Aug 16 '16 at 17:23
  • Did you mean dist-upgrade in your final paragraph? – Paul Cager Aug 17 '16 at 12:13
  • @PaulCager it was a general statement. For Debian-based it's dist-upgrade, but for the others are yum upgrade and zipper dup. – yzT Aug 17 '16 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.