Keeping Debian up to date

[Voipy]

With the increasing speed at which vulnerabilities are being picked up, we want to stay ahead of any issues and keep Debian as up-to-date as possible.

Is it always safe to run the below? Should we exclude anything to be safe?

sudo apt updates
sudo apt upgrade

 

[yaboc]

With the increasing speed at which vulnerabilities are being picked up, we want to stay ahead of any issues and keep Debian as up-to-date as possible.

Is it always safe to run the below? Should we exclude anything to be safe?

sudo apt updates
sudo apt upgrade

good question. i always backup before doing apt update && apt upgrade -y and obviously fspbx upgrades and so far everything works fine, but it'd be good to hear feedback from @pbxgeek

 

[pbxgeek]

I’d definitely back up before any major OS update. It's hard to predict what each update will do or whether it might break dependencies. I'd avoid updating PHP. We addressed the vulnerability as soon as it was announced with a coordinated FS PBX update. Some people updated manually too soon, which caused some services to stop working. Nothing serious happened; they just needed a restart. The FS PBX update handles that automatically, so there are no issues.

 

[Voipy]

yeah I always back up as a matter of course. We used to leave debian alone in the past for long (way too long really) times. But with all the crap happening out there we now want to start updating regularly. Damned if you don't - and sometime if you do I guess.

 

[gw22]

Definitely interested in this - afraid to update in fears of breaking something

 

[gw22]

I’d definitely back up before any major OS update. It's hard to predict what each update will do or whether it might break dependencies. I'd avoid updating PHP. We addressed the vulnerability as soon as it was announced with a coordinated FS PBX update. Some people updated manually too soon, which caused some services to stop working. Nothing serious happened; they just needed a restart. The FS PBX update handles that automatically, so there are no issues.

"Avoid updating PHP" - if you do this apt update && apt upgrade -y , does it not upgrade PHP? If so, how do we prevent?

 

[Voipy]

First run:

apt-mark hold "php*"

then update

Then, if you want:

apt-mark unhold "php*"

 

[gw22]

@Voipy thank you

 

[marc8lange]

Following on from this thread, I'd like to hear how others handle security updates, especially on an HA pair.

My setup: two FS PBX nodes in an HA pair, Debian 12 (bookworm), FreeSWITCH built by the FS PBX installer, PostgreSQL 17 from the PGDG repo, PHP 8.1/8.5 from the third-party PHP repo.

What I found when I checked:
- Node A has unattended-upgrades running. It has been quietly installing things like imagemagick, apt and rsync (rsync went to 3.5.0, a big security release with behaviour changes).
- Node B never had unattended-upgrades installed. It is now 152 packages behind, including a kernel, nginx security fixes and the old rsync. It had been up 42 days.
- Because Node A only allows Debian origins, PHP and PostgreSQL (third-party repos) are NOT auto-updated. Only Debian packages are. So the two nodes have drifted apart without me noticing.

This is Node A's config (/etc/apt/apt.conf.d/50unattended-upgrades, comments removed):

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian";
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};
Unattended-Upgrade::Package-Blacklist {
};

Note the first line also lets point-release updates through, not just security fixes, and the blacklist is empty.

My worry with auto on a live HA node: some library updates (libc, libssl) can restart other services when they install, and if both nodes patch on the same night you could restart both at once. If I did go auto, I'd tighten it to something like this:

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};
Unattended-Upgrade::Package-Blacklist {
    "php";
    "postgresql";
    "keepalived";
};
Unattended-Upgrade::Automatic-Reboot "false";

(security-only, call-path packages excluded, no auto-reboot, and the two nodes set to patch on different days).

Questions for you:
1. Do you run unattended security updates, or do you only get notified and apply them by hand?
2. If you run an HA pair, do you stagger the nodes or patch the standby first and fail over?
3. Has anyone had an automatic update restart FreeSWITCH, PostgreSQL or keepalived at a bad moment?
4. Do you hold PHP and PostgreSQL the way suggested earlier in this thread, and if so how do you remember to patch them?

Thanks, curious what people actually do in production.

 

[RCCradio]

I would never use auto-update on a production machine. This leaves you open to a lot of headaches if the update fails in the middle of the night. I would manually update each server, do one and make sure everything is running correctly, then do the other one, maybe the next day. Just set a schedule so Server 1 is ran on Monday, and Server 2 is ran on Tuesday. This way you are present and able to take care of any issues that may pop-up.