Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Assume you have a server that is non-Windows, how do you keep track if you server software is up-to-date?

Meaning, what tool already exists that will send me automated alerts to inform me that my any piece of software on my server (e.g. the os, the app server, the database, the web server, etc) is out-of-date?

share

migration rejected from stackoverflow.com Sep 5 '13 at 11:30

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by Magellan, TheCleaner, Falcon Momot, Ward, Nathan C Sep 5 '13 at 11:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Falcon Momot, Nathan C
If this question can be reworded to fit the rules in the help center, please edit the question.

    
@JakeW: Off topic on SO? –  Gens Jun 17 '11 at 3:38
1  
I'm pretty sure this is a dup: at least in reference to Linux, but I can't find the question I thought I saw a couple weeks ago. –  Ward Jun 17 '11 at 5:41
comments disabled on deleted / locked posts

5 Answers 5

I don't there is one software that does it all. I'm very much a "if it ain't broke don't fix it" kind of guy, and only prefer to install security updates. For Windows WSUS gets it done, for Linux there are tools for each distribution's package management. It's also typical for my to setup a Nessus server and do some regular scans for vulnerabilities.

share
add comment

Going to have to disagree with the previous users. I'd recommend spacewalk:

http://spacewalk.redhat.com/

It's the open source version of Red Hat Satellite Server.

If you are not running Linux, please disregard.

share
1  
RHN Satellite / Spacewalk is hands down one of the best choices for solving the OP's question. It is very easy to view the current status of systems and weather or not they are up to date. It is even possible to push updates to remote systems if configured to do so. Is RHN Satellite / Spacewalk perfect? No, but a lot of effort is being made to improve it. –  Red Tux Nov 14 '11 at 4:54
add comment

As for nearly any periodic: cron

Script should only check if available.
Actual upgrades should be done with great care.

e.g. Gentoo (portage):

#!/bin/bash  
emerge --sync --quiet  
emerge world --update --deep --newuse --pretend --verbose --tree --quiet

Similar for other package managers.

share
add comment

In general, you don't do such a thing for any production server environment (whether Windows or not). Instead, engineering specifies a set of versions that work together correctly for the software/application(s) that they want to run on the server, and then the server is configured with those exact versions. Period. Do not auto-update, do not introduce any version changes/updates/patches that have not been properly vetted by engineering first, do not collect $200.

As such, I'd suggest fobbing such responsibility off onto the engineering team. If they want to use an updated version of something, then it is their responsibility to notice that the update is available, test it in their development environment, and certify that it will work correctly with the rest of the server components. To do otherwise invites disaster.

share
3  
If he's asking this question, do you think his company has an engineering team, release-control procedures, etc? –  mfinni Jun 17 '11 at 19:15
1  
I'm not saying that your answer is wrong; it just doesn't fit every scenario, every company. –  mfinni Jun 17 '11 at 20:16
    
This answer would only apply to a rather small percentage of us. Certainly doesn't apply to those like myself, as I'm the entire IT department. As for updates and patches, if they are at all security related they should be applied, after being tested in a test environment, and your engineering department should make adjustments as required to ensure everything they have is working correctly afterwards, which should have been determined in the test environment. Functionality at the expense of security is a disaster waiting to happen and an extremely poor business decision. –  John Gardeniers Jun 17 '11 at 23:21
    
Aroth, you do not take into account a known vulnerability which is certified, and placed into the production OS repository. How do you then know if all of your systems are up to date with the current patch set at that point, which the initial questioner was asking. –  Red Tux Nov 14 '11 at 4:52
add comment

Ubuntu has the unattended-upgrades package that can be configured to auto-install any updates, auto-install only critical update, or only send email when there are updates available.

See this Ubuntu howto for more information.

For my development servers I choose to auto-install only critical updates, but for production servers I would only recommend sending email. You probably want to check the changelog and test your systems before upgrading.

share
add comment