Skip to main content

Linux Patching

||||Linux Screen||

The Best Way to Patch Linux OS

By Patch ManagementNo Comments

The Best Way to Patch Linux OS

Linux is generally considered a more reliable OS to apply updates to, but not patching will expose your environment just like any other operating system.
[vc_single_image image=”38835″ img_size=”full” alignment=”center”]

How to Patch Linux

If you ever visit a Patch Tuesday article, you will often find comments about using Linux because of its reliability and lack of updates. This is often a huge misconception in the Linux community. Each Linux OS is different and some of the examples below show updates that are needed only a week after the servers were last fully patched.

Installing individual updates for Linux is relatively easy, but it requires you to know the name of the update you want to install.

The following process takes some time due to the use of the command line scripts. However, we recommend you learn the basics of “bash” (Bourne Again Shell), which is the Unix shell since it will greatly help the understanding of the process.

Both experts and the community are correct that the updates are more reliable with almost no Blue / Black Screen of Death (BSOD), but that doesn’t mean Linux doesn’t need to be updated.

Getting Started

  1. Establish a secure SSH remote console to the server, e.g. Putty or Telnet
  2. Run the following command line: apt list –upgradable | grep “-security”
[vc_single_image image=”31043″ img_size=”full” alignment=”center”]

Understanding the resultant screen shot above is essential, as each line records details of the package name, the version it upgrades to and the version installed. For example, the screen shot includes the following:

apparmor/xenial-updates,xenial-security 2.10.95-0ubuntu2.11 amd64 [upgradable from: 2.10.95-0ubuntu2.10]


Red: Name of package

Green: Name of upgraded package

Purple: Installed version of package

[vc_separator css=”.vc_custom_1561056820587{padding-top: 10px !important;padding-bottom: 10px !important;}”]

Where is the Severity and Update Description?

If you are used to Microsoft Windows Update (WSUS), you will notice the output of the script only produces the name of the missing update package. In fact, unless you search for the package name on the specific Linux OS website you will never know what are more important than others, or what the package is actually fixing.

Many industry experts believe this knowledge is essential when choosing which to prioritize, especially since many don’t have the time to install packages which are actually not security-related or very low in severity.

On the other hand, how would a Linux administrator know which package fixes a zero-day vulnerability or were absolutely essential to apply? Let’s continue with the install process:

  1. Identify the update(s) you wish to install (copy and paste is really useful)
  2. Run the following command line: sudo apt-get install <package name>=<version> For example, sudo apt-get install apparmor=2.10.95-0ubuntu2.11
[vc_separator css=”.vc_custom_1561056820587{padding-top: 10px !important;padding-bottom: 10px !important;}”]

Security Privileges

Because you are making changes to the system, your account must have SUDO security privileges, e.g. supervisor. Also pay attention to the spaces above as the command line needs to be exact in order to pass correctly to the Unix shell.

If you wish to install many updates at the same time, use a comma and paste the next update onto the line.

If you want to update a package to the latest version and not necessarily the version which has been detected, you can omit the version. However, this is not recommend or considered best practice due to the testing of specific versions of packages on your servers.

For example: sudo apt-get install apparmor

By default, all Linux packages are installed without a reboot.

Linux is generally considered a more reliable OS to apply updates to, but even so, the lack of patching will expose your environment just like any other operating system.

[vc_single_image image=”38151″ img_size=”full” alignment=”center” onclick=”custom_link” link=””]

Patching Linux OS with Syxsense

Syxsense has many automation benefits to the manual patching methodology above. With the discovery process, all Linux devices can be detected and inventoried. Our Patch Manager displays the packages missing just like the scripts above, only we include additional information that is important to IT managers like the description, the vendor severity, and the independent CVSS score which is the cutting edge of vulnerability severity assessment.

Identifying zero-day updates is made easy with the color coding of the interface. The scheduler used to deploy the updated packages allowed flexible timing and reboot behavior to be set with ease. Enable your Linux Administrator to utilize their resources more efficiently by allowing them to automate and report on the patching of your Linux environment.

[vc_separator css=”.vc_custom_1552427883977{padding-top: 20px !important;padding-bottom: 20px !important;}”]

Experience the Power of Syxsense

Syxsense has created innovative and intuitive technology that sees and knows everything. Manage and secure your environment with a simple and powerful solution.

[vc_btn title=”Start a Free Trial” style=”gradient-custom” gradient_custom_color_1=”#da4453″ gradient_custom_color_2=”#8a2387″ shape=”round” size=”lg” align=”center” link=”url:%2Fstart-a-free-trial-of-syxsense|||”]

Most Linux Builds Need an Immediate Patch

By News, Patch ManagementNo Comments
[vc_single_image image=”25413″ img_size=”full”]

An Attacker Could Take Over Impacted Systems With 3 Commands or Less

A security researcher has discovered a highly critical flaw in X.Org Server package that impacts OpenBSD and most Linux distributions, including Debian, Ubuntu, CentOS, Red Hat, and Fedora.

The flaw, tracked as CVE-2018-14665, was introduced in X.Org server 1.19.0 package that remained undetected for almost two years and could have been exploited by a local attacker on the terminal or via SSH to elevate their privileges on a target system.

The X.Org foundation has now released X.Org Server version 1.20.3 with security patches to address the issue. While, popular distributions like OpenBSD, Debian, Ubuntu, CentOS, Red Hat, and Fedora have published their advisories to confirm the issue and working on the patch updates.

All Linux vendors are recommending all customers update their operating systems as quickly as possible, all patches are available from OS vendors to address the vulnerability and are now available in Syxsense for immediate deployment.

Our discovery scan will identify every device with an IP address connected to your networks, including Linux devices.

Then, thanks to a comprehensive collection of inventory information, you can easily filter the device view and see which Linux devices need the required updates.

Within minutes you will have identified vulnerable devices and started a strategic remediation. Start a free trial of Syxsense and patch your Linux devices.

[dt_default_button link=”|||” size=”big” button_alignment=”btn_center”]START FREE TRIAL[/dt_default_button]