Update your kernels

Adam

Just a reminder to always stay on top of kernel updates. Ubuntu are very quick to publish updates when vulnerabilities are discovered but these are not applied automatically.

If a new kernel package is installed, remember to reboot to activate the new kernel.

AdamM

Adam
I guess Enhance doesn't use this software?
https://www.phoronix.com/news/GitHub-Disables-XZ-Repo

"Today's disclosure of XZ upstream release packages containing malicious code to compromise remote SSH access has certainly been an Easter weekend surprise... The situation only looks more bleak over time with how the upstream project was compromised while now the latest twist is GitHub disabling the XZ repository in its entirety "

Edit - sory, I noticed now that this topic has already been discussed on the forum

deydod

Quick how to and what commands should we run, might help those who are not that savvy in kernel updates.

Nickske00

deydod Just do apt update && apt upgrade if there is a kernel package in the list of updates: reboot. Not that hard.. 🙂

twest

Buy Kernelcare. It's $3/mo and you'll get automatic kernel updates with no need for reboots.

Shaijee

twest Buy Kernelcare. It's $3/mo and you'll get automatic kernel updates with no need for reboots.

Are you using it? If so, could you please share the details on how to set it up?

twest

Shaijee yep, been using it for years and had it on all my Enhance servers for about 1 year. Works like a charm. You can use the install instructions on their site, or from pretty much anywhere, it's extremely simple, 1 command pasted in command line and you're set.

ivansalloum

twest I don’t think it will prevent your server from rebooting. You still need to reboot to load the new kernel whenever there is a new one. It only patches security updates live.

Shaijee

Nickske00 Don't you clean up old kernels and unused dependencies and packages?

Also, how would you reboot busy servers with lots of clients' sites?

deydod

Yes, I know how to update kernels, but I am sure that there folks that may need instructions.

JohnB

deydod Honestly if someone doesn't know how to do this they shouldn't be hosting an Enhance instance even for their own sites. Its really basic and the absolute easiest part of server admin.

And if someone can't be bothered to google basic things it usually indicates either laziness or in so far over their head they don't know what to google. Both of these options are not great for setting up and managing hosting.

twest

Shaijee reboot at night when everyone is asleep lol

Nickske00

Shaijee Yeah, sometimes I also do an apt autoremove to clean up old things. 🙂

Shaijee

twest

LOL

twest

ivansalloum you mean with Kernelcare? No, you don't have to reboot. It "live patches" the kernel. Ubuntu actually has a similar feature available for a no-reboot-kernel-update, Ubuntu Pro.

The whole point of Kernelcare/Ubuntu Pro is that it relieves you of the need to reboot. That's the #1 reason it's so popular. Check it out, it's pretty great 🥰

ivansalloum

twest I already use the Canonical Livepatch service and I wrote a guide about it on my website as well and it doesn't prevent your server from rebooting. It only prevents from rebooting when there is a security patch. I'm talking about new kernel updates (new versions). This need a reboot anyways. KernelCare would patch security updates lives, that's true, but it won't load a new kernel version live.