Mastodon Feed: Post

brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary:") wrote:

#Sysadmin tip: You can set up unattended-upgrades (Ubuntu instructions here, also works for Debian but Debian doesn't turn this on automatically) to deal with security updates within a day of patching without having to do it manually.

I also recommend installing needrestart so that important services get restarted on upgrade, reducing the chance of vulnerabilities staying live for a long time.

For kernel updates, it appears you can configure it to automatically reboot with the Unattended-Upgrade::Automatic-Reboot "true";. This will of course create a small amount of downtime for the server, which I consider an acceptable trade-off for a small server like mine.

There are also ways you can livepatch kernels iirc but I don't know those techniques so well, you might want to look into them for a larger/more professional server.

Keep patching and stay safe out there!