334
Serious Linux vulnerability affecting nearly every system. Patch your systems. (copy.fail)
submitted 4 months ago by to c/selfhosted@lemmy.world
74 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 4 months ago (1 child)

I have a mix of Debian and Ubuntu servers. I'll update manually anyway but for future cases, would unattended-upgrades set to security upgrades run daily be enough to stop this type of issue?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 14 points 4 months ago* (last edited 4 months ago) (1 child)

    This is a kernel bug, unattended-upgrades will take care of installing the new kernel once the fix is published, but you still have to reboot to load it. I've set up a cron job that runs needrestart nightly and reboots my servers if there is a pending kernel upgrade [1]

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 4 months ago* (last edited 4 months ago) (2 children)

    Unattended-upgrades has a config option to auto reboot

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 4 months ago*

    Every time I see people boasting about their uptime, I ask myself how old their kernel actually is.

    I've set this auto reboot and never had to worry about patching my server.

    Edit: yeah I know live patching is a thing, not worth the hassle for 99% of server workloads.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 4 months ago (1 child)

    True.

    But by default the unattended-upgrades timer has a randomized trigger time (so that not all Debian machines in the world start hammering the mirrors at the same time). If you enable the auto reboot option in unattended-upgrades, your boxes will reboot at an unpredictable time. I prefer doing this at known times (middle of the night when I know nothing important is running/number of users is low).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •