up vote 3 down vote favorite
share [g+] share [fb]

Assume you have a server that is non-Windows, how do you keep track if you server software is up-to-date?

Meaning, what tool already exists that will send me automated alerts to inform me that my any piece of software on my server (e.g. the os, the app server, the database, the web server, etc) is out-of-date?

link|improve this question
@JakeW: Off topic on SO? – Gens Jun 17 '11 at 3:38
1  
I'm pretty sure this is a dup: at least in reference to Linux, but I can't find the question I thought I saw a couple weeks ago. – Ward Jun 17 '11 at 5:41
feedback

migrated from stackoverflow.com Jun 17 '11 at 4:08

This question came from our site for professional and enthusiast programmers.

5 Answers

up vote 3 down vote

I don't there is one software that does it all. I'm very much a "if it ain't broke don't fix it" kind of guy, and only prefer to install security updates. For Windows WSUS gets it done, for Linux there are tools for each distribution's package management. It's also typical for my to setup a Nessus server and do some regular scans for vulnerabilities.

link|improve this answer
feedback
up vote 3 down vote

Going to have to disagree with the previous users. I'd recommend spacewalk:

http://spacewalk.redhat.com/

It's the open source version of Red Hat Satellite Server.

If you are not running Linux, please disregard.

link|improve this answer
1  
RHN Satellite / Spacewalk is hands down one of the best choices for solving the OP's question. It is very easy to view the current status of systems and weather or not they are up to date. It is even possible to push updates to remote systems if configured to do so. Is RHN Satellite / Spacewalk perfect? No, but a lot of effort is being made to improve it. – Red Tux Nov 14 '11 at 4:54
feedback
up vote 2 down vote

As for nearly any periodic: cron

Script should only check if available.
Actual upgrades should be done with great care.

e.g. Gentoo (portage):

#!/bin/bash  
emerge --sync --quiet  
emerge world --update --deep --newuse --pretend --verbose --tree --quiet

Similar for other package managers.

link|improve this answer
feedback
up vote 1 down vote

In general, you don't do such a thing for any production server environment (whether Windows or not). Instead, engineering specifies a set of versions that work together correctly for the software/application(s) that they want to run on the server, and then the server is configured with those exact versions. Period. Do not auto-update, do not introduce any version changes/updates/patches that have not been properly vetted by engineering first, do not collect $200.

As such, I'd suggest fobbing such responsibility off onto the engineering team. If they want to use an updated version of something, then it is their responsibility to notice that the update is available, test it in their development environment, and certify that it will work correctly with the rest of the server components. To do otherwise invites disaster.

link|improve this answer
3  
If he's asking this question, do you think his company has an engineering team, release-control procedures, etc? – mfinni Jun 17 '11 at 19:15
1  
I'm not saying that your answer is wrong; it just doesn't fit every scenario, every company. – mfinni Jun 17 '11 at 20:16
This answer would only apply to a rather small percentage of us. Certainly doesn't apply to those like myself, as I'm the entire IT department. As for updates and patches, if they are at all security related they should be applied, after being tested in a test environment, and your engineering department should make adjustments as required to ensure everything they have is working correctly afterwards, which should have been determined in the test environment. Functionality at the expense of security is a disaster waiting to happen and an extremely poor business decision. – John Gardeniers Jun 17 '11 at 23:21
Aroth, you do not take into account a known vulnerability which is certified, and placed into the production OS repository. How do you then know if all of your systems are up to date with the current patch set at that point, which the initial questioner was asking. – Red Tux Nov 14 '11 at 4:52
feedback
up vote 1 down vote

Ubuntu has the unattended-upgrades package that can be configured to auto-install any updates, auto-install only critical update, or only send email when there are updates available.

See this Ubuntu howto for more information.

For my development servers I choose to auto-install only critical updates, but for production servers I would only recommend sending email. You probably want to check the changelog and test your systems before upgrading.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard