search

ilri / rmg-ansible-public

Ansible playbooks for ILRI research-computing infrastructure
GNU General Public License v3.0
8 stars 2 forks source link

Security updates using unattended-upgrades #54

Open oguya opened 8 years ago

oguya commented 8 years ago

We've been using cron-apt to automatically apply security updates. unattended-upgrades also does the same thing, but better. I think we should give it a try. What's your recommendation @alanorth ?

oguya commented 8 years ago

I think we can also configure it to automatically reboot a host—common web servers—at a specific time if /var/run/reboot-required file is created by an upgrade. https://github.com/ilri/rmg-ansible-public/blob/unattended-upgrades/roles/common/templates/apt.conf.d/50unattended-upgrades.j2#L48-L55

alanorth commented 8 years ago

I dunno. I don't like the idea of servers automatically rebooting. We don't monitor them well enough to notice if one doesn't come back. I think applying userland security updates like openssl, nginx, bash, etc is a no brainer — but not kernels.