Computer security is an issue of paramount importance. More even so whenever we are running services exposed to the internet. Much more even so when those services can compromise sensitive data.
The first piece of advice you will always get is "keep your system up to date with the latest security patches", and my favourite way of keeping my Debian systems safe is through the unattended-upgrades package.
Automatic security updates are handy when we are managing a considerable number of servers but we want to be careful as things can break for users or our coworkers, so choosing the right configuration and having a predefined procedure can save us some headaches.
This is included in the latest release of NextCloudPi.
Alternatively, you can install it offline into a Raspbian SD card using QEMU.
AUTOREBOOT: type yes to allow automatic reboots when needed.
In this setup, automatic reboots will only be run when needed, and will be run at 4:00 am.
Also, some settings will be configured for you: .deb packages will be cached for 2 weeks, and a periodic apt-get autoclean will be run every week to prevent the autoupdate setup to take up too much storage.
See the code below for details. If you have different needs, continue reading.
, which will update package lists and perform security updates daily ( see parameter "1" ).
Your updates will be run from /etc/cron.daily/apt. That file is also worth a reading if you like tweaking things, like for instance scheduled apt-get autoremove.
[update] Raspbian does not support the Raspbian-Security label. For Raspbian, it is either update nothing or everything, security or not. See this forum thread.
DESCRIPTION="unattended upgrades: automatically install security updates. Keep your cloud safe"
theres a new new update available. how do i update to that?
If you have further questions just ask!
I activated unattended-upgrades through nextcloudpi-config and noticed that the configuration file "/etc/apt/apt.conf.d/50unattended-upgrades" has no Origins-Pattern defined. The daily logs in "/var/log/unattended-upgrades/unattended-upgrades.log" showed "Allowed origins are: ".
My first question: Why is there no pattern like "o=Raspbian,a=stable,l=Raspbian-Security"; so that the logs show "Allowed origins are: ['o=Raspbian,a=stable,l=Raspbian-Security']" and one knows what is being upgraded?
My second question: Should I avoid including a pattern like "o=Raspbian,a=stable,l=Raspbian" for non-security updates? I suspect that could conflict with the update policy of the NextCloudPi project.
My third question: Does a NextCloudPi update overwrite my changes to e.g. "/etc/apt/apt.conf.d/50unattended-upgrades"?
Many thanks for your feedback and for noticing that. Please, could you copy-paste your questions on github, so we can continue the conversation over there?
I was very surprised to learn that Raspbian-Security is not a thing for Raspbian. I wrote a post asking for it. It would be great if more people helped deliver pressure on the Raspbian developers to implement this.
edit: Regarding your last question… NextCloudPi only works with /etc/apt/apt.conf.d/20nextcloudpi-upgrades, so any changes to /etc/apt/apt.conf.d/50unattended-upgrades will not be overwritten by NCP.
Hi, thank you for the quick fix and sorry for not pasting the question to github right away.
and (dummy) upgraded all the updated packages . I think it works fine now.
– and that you use the codenames (n=jessie and n=stretch) in your patterns to follow the migration of those releases.
I think I will stick to the default NextCloudPi patterns.
I also read your post about the Raspbian-Security Label and felt pretty suprised too.
By the way, great project.
Great, many thanks for the feeback!