18

On my EC2 server, when I do sudo apt-get update && sudo apt-get upgrade, I see:

The following packages have been kept back:
  linux-ec2 linux-image-ec2 linux-image-virtual linux-virtual

Should I go ahead and do sudo apt-get install linux-ec2 linux-image-ec2 linux-image-virtual linux-virtual to force these packages to be upgraded?

Improve this question
1
  • 3
    Or do apt-get update && apt-get upgrade && apt-get dist-upgrade. That will upgrade the held back packages.
    – Mark Russell
    Oct 4, 2011 at 21:11

1 Answer 1

Reset to default
18

The short answer is, yes, you should keep your systems up to date with respect to security patches.

How exactly you roll out the security patches depends on your tolerance for risk. Here are some options that I have used to answer this question in the past:

  1. Apply the upgrades to a set of QA systems that mimic your production environment and run all your regression tests to make sure that the changes don't break any functionality or cause performance issues. Once you're satisfied, roll out the upgrades to your production systems.

  2. Wait a day and see if there is a public outcry about problems caused by the updates. If all seems peaceful, upgrade your production systems.

  3. Apply every security patch on your production systems as soon as it's available.

I have used a combination of all three of these approaches using Ubuntu, and have gradually moved towards option 3 over the years. Security patches are heavily tested before released and great care is taken to not break existing functionality. I've never had a problem upgrading within the Ubuntu supported images (though I did once have an issue years ago when I was using a non-Ubuntu kernel with Ubuntu on EC2).

Note that upgrading the kernel also requires a reboot to apply the changes.

The above experience and recommendations apply only to upgrading within an Ubuntu release (e.g., 11.04). Upgrading to a new Ubuntu release is a much larger and riskier task and definitely requires testing before you roll it out to your production systems.

Here's an article on this topic that was just published by RightScale about how to manage security upgrades in their environment:

http://blog.rightscale.com/2011/09/28/security-patching-in-the-rightscale-universe/

Improve this answer
3
  • 3
    Good answer. Perhaps add a note that upgrading the kernel is only really possible on EBS-backed instances? That's still the case, no?
    – Mark Russell
    Oct 4, 2011 at 21:11
  • 3
    Mark: It used to be true that instance-store instances could not have their kernels upgraded in place, but with the release of paravirtualization a while back, the actual kernels can be stored on the AMI and not the AKI. This means that the instance can upgrade the kernel on its local EBS volume and have it stick after a reboot even though it's using the same AKI. I just tested this with Ubuntu 11.04 (us-east-1 ami-e2af508b) and the instance-store instance came up with the correct newer kernel after a dist-upgrade and reboot.
    – Eric Hammond
    Oct 4, 2011 at 23:49
  • 2
    correction to my previous comment: "the instance can upgrade the kernel on its local instance-store root volume and have it stick"
    – Eric Hammond
    Oct 5, 2011 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .