Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Following the recent heartbleed vulnerability of OpenSSL, I would like to keep my EC2 machines updated on a regular basis. The naive approach would be setting an hourly cron job for security updates (sudo apt-get update && sudo unattended-upgrade).

Are there any risks of doing that? Is there a recommended update mechanism for EC2 machines?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The unattended-upgrades package is the standard way to automatically apply important bug fixes and security patches in Ubuntu.

I recommend installing this on every Ubuntu system.

sudo apt-get update &&
sudo apt-get install unattended-upgrades

You don't need to create your own cron job. The package installs one for you.

You can edit the default configuration if you'd like to alter its behavior.

https://help.ubuntu.com/12.04/serverguide/automatic-updates.html

share|improve this answer
    
Any thoughts on the advisability of doing this on a production server? It makes me nervous to have changes quietly applied and risk the possibility of the update failing or introducing problems. –  ianjs Apr 14 at 2:19
    
By "every" I meant production systems, too. I've been auto applying Ubuntu security patches for many years and can't remember any serious issues. It makes me nervous to have a production server sitting there without patches to known security issues and risk the possibility of having them exploited. That said each situation has different needs, so you may be better off going through a rigorous testing phase for each patch. Be aware, though, that they are released all the time, so you'll be busy. –  Eric Hammond Apr 19 at 18:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.