8

I can't seem to find an agreed answer on this anywhere, so I figured I'd ask it myself.

I have five Ubuntu servers running either 12.04 or 14.04, should I enable automatic security updates on these using unattended-upgrades? Or should I just run manual updates every month?

By this I mean is it safe/could enabling these lead to any OS/security issues? Do the benefits outweigh the cons?

1
  • Even for windows I would allow updates to automatically be applied. I rather risk the unlikely scenario of an update breaking something than a system being compromised. It's an acceptable trade off.
    – aseq
    May 12, 2015 at 8:12

5 Answers 5

4

It depends on what your machine does ultimately. Does it run mission critical applications that can not crash EVER? Probably not the best for auto updates then. Is it sitting on the egress point of your network? probably a good candidate.

It comes down to weighing security vs stability and finding what your acceptable compromises are. Most likely you're not going to be the target of a zero day but maybe you have very sensitive data that absolutely can't get out, it's a decision you have to make.

My suggestion is to design your network in such a way that the most security filtering is done on the edge of your network (blocking external applications, smart fire-walling, possible DMZ, etc.) and then treating the rest in a way that is most appropriate for your organization - whether that means nightly reboots with updates or weekly or automatic :)

2

Yes. You should enable these automatic updates. You are far more likely to have your system compromised by missing or delaying an update than for these updates to impact your running system negatively.

2

I think it is a good idea to enable unattended-upgrades.

I have used unattended-upgrades for years on both debian stable and ubuntu lts releases and never found a problem with it. Just as long as you only enable the security updates, and perhaps the regular updates. And unattended-upgrades will not update something if it needs user input

Generally speaking if you stick with stable releases of debian or ubuntu, or redhat/centos, you can be sure that their updates are stable and do not mess up anything.

If you depend on something like apache, you can selectively tell the package manager to not update it and do that by hand.

Besides, I rather risk breaking something than having a server hacked due to missed security patches.

1

My rule of thumb is that I leave security (and often non-security, also) update enabled on virtual machines, but I manually schedule a system update on bare-metal instances.

After all, with a VM and a good backup strategy is very easy to recover, while with bare-metal things become more complex.

0

In an ideal world in addition to your production servers you have additional non-production systems intended to test both (updates to) your own applications as well as the OS.

Only once you have validated in that test environment that non of the updated software components break your existing configuration should those be applied to your production environment.

That would advocate against automated updates.

Typically you do want a certain level of automation such that once you do schedule an update, you don't have to log on to each individual system to manually patch them :)