I am in need of expert advice:

Our system admin who is new to Ubuntu in particular and *nix in general is reluctant to install any updates. His view is what if after installing updates the system becomes unstable and doesn't boot up? He has some horror stories from past life as Windows sys-admin.

Some in our team believe this is suicidal as not installing (at least) security updates is opening up to malicious attacks.

It was suggested to run sudo unattended-upgrade so that at least security updates be installed, however even this sometimes requires system to be restarted.

I really appreciate expert comments on this? Thanks.

  • @Lucio askubuntu.com/questions/193222/… – Thomas Ward Mar 19 '13 at 1:59
  • This attitude from a system administrator is terrifying! The people in your team who take a dim view of not updating are correct. You may want to post a similar (but not the same) question someplace Windows is supported, specifically to get advice on how to convince him that Windows needs updates, too. If he still administers any Windows machines and doesn't install updates, then he's probably endangering your company even more than by failing to install updates to your Ubuntu machines. – Eliah Kagan Mar 19 '13 at 7:05

Personally, I think that's a hard position to defend. Machines should periodically have security updates installed. This includes kernel security updates, which require reboots (unless you fancy living life on the edge with Ksplice).

He should be paying attention to the security flaws applicable to the platform as they emerge. Recently, notably, we've seen a number of privilege escalation bugs (which allow normal users to become root). There are in-the-wild exploits for at least one of these (albeit, I don't think it affects 12.04). There are a steady stream of bugs getting patched for lesser applications which fix remote code execution, DOS, priv escalation flaws, etc. There are plenty of attack vectors getting patched regularly.

That said; the final decision of whether or not to patch depends entirely on the context. If you're talking about an Internet-facing webserver, or end-user boxes, then your sysadmin is insane. If you're talking about a high-availability internal production system behind layers of network security in a trusted environment, then that's a little different, and your sysadmin may be being quite pragmatic.

I.e, if the main threat to the box is from its own employees, then is patching a few DOS holes really worth the downtime and risk to production stability? Probably not, no.

Of course, threats can get inside the network perimeter. But again, it depends on your network, your company, your setup... in many small companies, that may already be pretty much game over. The attacker may already have all the access he needs to access these boxes via passwords or keys stored elsewhere on the network, or via impersonation, sniffing, etc. In other words, patching a few holes on a couple of systems might be like starting to build a fence after the horses have bolted.

Bottom line: machines should really see security updates. It doesn't have to be a total unknown; test systems can be (and should be) brought up and upgraded in the same manner as a test-run prior to the event.

But don't ever forget that security is a balancing act. The totally secure system is one buried miles underground, with no connectivity, no power, and no data. If all you're protecting yourself from are a few trusted employees, then what's the point?

  • The box in question is internet-facing, hosts public web applications. – Kamal Mar 19 '13 at 3:05
  • There are many more details to go into; what perimeter security is in place, which web stack you're using, etc, but this isn't really an appropriate forum for that. Based on what you've told us, his attitude is unacceptable, and you should be highly concerned. The fact that he's new to nix only makes it worse, since he's less likely to configure everything securely. – IlluminAce Mar 19 '13 at 8:06
  • I would add that installing non-security updates also makes sense. Those updates have a tendency to reduce, rather than increase, problems such as crashes. (I have found that the same applies to Windows.) – Paddy Landau Mar 26 '13 at 10:27

I have never faced a problem with ubuntu 12.04 updates becoming unstable, if not updated every thing would run normal but the bugs will never be fixed. Linux is quite secure but like you said needs security updates. There haven't been any attacks on linux but you should be safe any ways by installing an anti-virus software again I have never seen an update that's makes LTS unstable you can also chose what updates to install in the update manager.

I hope this helps

  • 1
    "There haven't been any attacks on linux…" That is absolutely not true — there have been attacks on Linux. However, because of its nature, flaws that allow successful attacks on Linux are fixed very soon after being discovered, often within hours. To my knowledge, there are currently no known viruses "in the wild" for Linux; but this does not apply to certain browser-based attacks. In support of your statement, however, I personally have not seen any validated claims of successful malware attacks on desktop Linux, except where standard security procedures have not been followed. – Paddy Landau Mar 27 '13 at 15:45
  • I know the most common one is bliss virus – Goku Mar 27 '13 at 20:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.