Lesson 6.9: Controlled package updates
Most break-ins use vulnerabilities that already have a fix; the fix just wasn't installed. Ubuntu can install security updates by itself every day with unattended-upgrades, but some packages, such as a database server, should only be upgraded in a planned window because the upgrade restarts them. apt-config shows the settings apt really uses, apt-mark hold keeps a package where it is, and a dry run shows exactly what the automatic job would do. In the lab you find that automatic updates were switched off on web02, turn them back on, hold MySQL for its maintenance window and check the result.
16 min
You will learn to
- Explain why patch speed matters
- Read apt's effective settings with apt-config
- Enable unattended security updates
- Hold a package with apt-mark
- Check the automatic run with a dry run
Key terms
- Security pocket
- The archive with security fixes for a release (noble-security).
- unattended-upgrades
- Installs updates from allowed origins automatically, daily.
- apt-config dump
- Prints apt's effective settings, merged from all files.
- Hold
- A mark that stops a package from being upgraded.
- Maintenance window
- An agreed time for changes that may interrupt a service.
← Working with users and groups · All lessons · Kernel modules and the taint flag →