On Thursday 23 February 2017, Carlos E. R. wrote:
> On 2017-02-23 13:46, Ruediger Meier wrote:
> > On Thursday 23 February 2017, Carlos E. R. wrote:
> >> El 2017-02-22 a las 11:37 +0100, Ruediger Meier escribió:
> >>> ... and it happened again. They upgraded 42.3 to texlive-2016 and
> >>> it breaks again. Evergreen is still needed.
> >>
> >> That will be solved eventually, I hope.
> >>
> >> What worries me is that we got 2 kernel updates in a month.
> >> Several updates this month that require a reboot (systemd,
> >> apparmor...). Not good for server uptime.
> >
> > You DO NOT NEED to reboot after kernel update. Nowadays the old
> > kernel should be still installed in parallel so module loading
> > still works without reboot.
>
> If I do that, then I would simply not apply the update at all. Far
> easier and more stable.
Hm, I never care about updates. I get them automatically everyday and
reboot whenever I want. I think that's more simple. Regarding stability
I don't think it makes any difference whether you install a kernel
update 5 minutes or 5 months before reboot.
BTW very often even the "non-reboot" updates require manually
restarting affected programs. Otherwise you would still use the
old versions too.
For example, below you see all the programs which are still using
vulnerable openssl. The fact that it's still running the old kernel
is my smallest problem ;)
glaukos:~ # uptime
14:10pm up 14 days 20:26, 1 user, load average: 3.34, 3.32, 3.32
glaukos:~ # rpm -qa --last | head
mariadb-10.0.29-18.1.x86_64 Tue 21 Feb 2017 01:00:13 AM CET
mariadb-errormessages-10.0.29-18.1.x86_64 Tue 21 Feb 2017 01:00:11 AM CET
mariadb-client-10.0.29-18.1.x86_64 Tue 21 Feb 2017 01:00:11 AM CET
openssl-1.0.2j-4.1.x86_64 Tue 21 Feb 2017 01:00:10 AM CET
libmysqlclient18-10.0.29-18.1.x86_64 Tue 21 Feb 2017 01:00:10 AM CET
expat-2.1.0-19.1.x86_64 Tue 21 Feb 2017 01:00:10 AM CET
libseccomp2-2.3.1-3.1.x86_64 Tue 21 Feb 2017 01:00:09 AM CET
libopenssl1_0_0-1.0.2j-4.1.x86_64 Tue 21 Feb 2017 01:00:09 AM CET
libexpat1-2.1.0-19.1.x86_64 Tue 21 Feb 2017 01:00:09 AM CET
kernel-default-4.4.46-11.1.x86_64 Wed 15 Feb 2017 01:00:13 AM CET
glaukos:~ # uname -r
4.4.36-8-default
glaukos:~ # zypper ps
The following running processes use deleted files:
PID | PPID | UID | User | Command | Service | Files
------+------+------+------------+-------------+---------+------------------------------------
1 | 0 | 0 | root | systemd | |
/usr/lib64/libseccomp.so.2.3.0
| | | | | |
/lib64/libapparmor.so.1.3.0
1077 | 0 | 0 | root | systemd | |
/usr/lib64/libseccomp.so.2.3.0
| | | | | |
/lib64/libapparmor.so.1.3.0
1152 | 1 | 499 | messagebus | dbus-daemon | dbus |
/usr/lib64/libexpat.so.1.6.0
1635 | 1 | 492 | nagios | nrpe | nrpe |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
1636 | 1 | 0 | root | sshd | sshd |
/lib64/libcrypto.so.1.0.0
1721 | 1 | 44 | named | named | named |
/lib64/libcrypto.so.1.0.0
| | | | | |
/usr/lib64/libmysqlclient.so.18.0.0
| | | | | |
/usr/lib64/libxml2.so.2.9.4
| | | | | |
/lib64/libssl.so.1.0.0
1743 | 1 | 0 | root | nmbd | nmb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
1807 | 1 | 0 | root | smbd | smb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
1808 | 1807 | 0 | root | smbd | smb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
1809 | 1807 | 0 | root | smbd | smb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
1855 | 1807 | 0 | root | smbd | smb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
2889 | 1 | 1000 | rudi | systemd | |
/usr/lib64/libseccomp.so.2.3.0
| | | | | |
/lib64/libapparmor.so.1.3.0
2893 | 0 | 1000 | rudi | systemd | |
/usr/lib64/libseccomp.so.2.3.0
| | | | | |
/lib64/libapparmor.so.1.3.0
14248 | 1807 | 0 | root | smbd | smb |
/lib64/libssl.so.1.0.0
| | | | | |
/lib64/libcrypto.so.1.0.0
You see I should restart at least named, smb, sshd and nrpe to be safe
against remote attackers.
cu,
Rudi
_______________________________________________
Evergreen mailing list
Evergreen@lists.rosenauer.org
http://lists.rosenauer.org/mailman/listinfo/evergreen
