How are you keeping your VM/VPS instances updated and secure? reddit / selfhosted ---------------------------------------------------------------------- failcookie · 2023-10-14 18:06 In the past, I've used services like Laravel Forge and Cleavr to scaffold my VM/VPS and keep them updated. It was super helpful since they had their own GUI for creating and routing sites. I've since moved to a more Docker-based setup for all of my projects, which are mostly just PHP/.NET/WordPress projects I'm spinning up and testing out. I do use Cloudflare Tunnel to open them up to the public so I can host sites like my personal blog. Right now, I've got 3 separate Linux VMs that I have on my HyperV. I'm looking to move away from the scaffolding services. How do you all keep your systems updated and keep it easy when you are spinning up a new VM/VPS? I don't do it often (like once a year), but it was definitely nice not having to remember everything I needed to setup from a security perspective. ---------------------------------------------------------------------- Koma52 · 2023-10-14 18:12 Ansible playbooks for new VM/VPS and I update them manually when I feel like it ---------------------------------------------------------------------- failcookie · 2023-10-14 18:14 Good idea on Ansible. It's one of those things I put off learning, but I meant to years ago. Thanks for the reminder! ---------------------------------------------------------------------- ddpbsd · 2023-10-14 18:24 Auto updaters set to automatically install security updates for local packages. Playing with diun for docker images ---------------------------------------------------------------------- Koma52 · 2023-10-14 18:25 And thanks for mentioning Cloudflare Tunnel. I'm already using Cloudflare for DNS but I never explored other services. But it looks interesting ---------------------------------------------------------------------- failcookie · 2023-10-14 18:29 There are definitely some wide opinions on it. For my use case, it has worked great and has been a nice option for me. But it has it's own privacy risks that is worth considering. There are some solid threads on it in this subreddit to check out though! ---------------------------------------------------------------------- lilolalu · 2023-10-14 18:29 https://wiki.debian.org/UnattendedUpgrades ---------------------------------------------------------------------- failcookie · 2023-10-14 18:30 Oh this is cool! I'll give it a go. I like that it sends Discord messages - super handy. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-14 18:46 Unattended upgrades for all my Ubuntu servers Auto patch for any Windows stuff Manually for Proxmox whenever Zabbix tells me it needs to patch Watchtower for my containers ---------------------------------------------------------------------- polspki · 2023-10-14 18:58 Single NixOS flake for all my servers/VMs, so I just run "nix flake update" and "nix run .#apps.nixinate.my-server" to apply the updates. ---------------------------------------------------------------------- MrSliff84 · 2023-10-14 19:06 Ansible Semaphore Docker and automated update/upgrade/reboot if necessary ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-14 19:38 If those instances are used by a limited number of users, just make HTTPS available only with authentication - either HTTP Basic, or mTLS. For public stuff, use unattended upgrades (with monitoring that your site's OK after updates) + DIUN. Also, there's [https://www.opencve.io](https://www.opencve.io) for more specific monitoring, like WP plugins etc. Dunno if it's possible to automate WP plugin updates, but at least you will know if something is discovered to be vulnerable. ---------------------------------------------------------------------- ddpbsd · 2023-10-14 19:42 I think I‘m only using the pushover notification. I got one recently and it freaked me out because I wasn’t expecting it ---------------------------------------------------------------------- _murb · 2023-10-14 21:11 Ansible playbooks that run via cron and log. Watchtower with logging for docker stuff. ---------------------------------------------------------------------- speculatrix · 2023-10-14 21:30 Old school cron job to run either yum -y update Or apt-get update ; apt-get upgrade And I just check these are failing ---------------------------------------------------------------------- didiatworkz · 2023-10-14 21:47 This is the way 👍 ---------------------------------------------------------------------- laser50 · 2023-10-14 23:49 Just checked unattended upgrades, also for a ubuntu server.. But it says "security and other" updates.. i run a webserver, would you know if the unattended upgrade could possibly decide to reboot my Mysql/apache service? Since the cache makes everything go brr and that goes on service restart I am hesitant. ---------------------------------------------------------------------- TomLutris · 2023-10-14 23:55 Crowdsec for security and monitoring ---------------------------------------------------------------------- athornfam2 · 2023-10-15 01:42 Action1RMM since it handles 3rd party apps and Windows updates. ---------------------------------------------------------------------- oriongr · 2023-10-15 01:47 I will add an Ubuntu Pro into the mix. Free for up to 5 servers ---------------------------------------------------------------------- talent_deprived · 2023-10-15 03:55 I ssh in and run the following on my Ubuntu servers: sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist- upgrade && sudo apt-get autoremove ---------------------------------------------------------------------- No-Reputation6322 · 2023-10-15 05:13 Watchtower ---------------------------------------------------------------------- Girgoo · 2023-10-15 06:23 Winget on Windows for application updates. I actually dont update ESXi 6.0 due to I don't want to lose performance on the Intel CPU bugs with heartbleed etc. It is a lab afterall. Auto update is the way to go. Just make sure to have backup if something goes wrong. ---------------------------------------------------------------------- Girgoo · 2023-10-15 06:25 Winget on Windows for application updates. I actually dont update ESXi 6.0 due to I don't want to lose performance on the Intel CPU bugs with heartbleed etc. It is a lab afterall. Auto update is the way to go. Just make sure to have backup if something goes wrong. ---------------------------------------------------------------------- Mabed_ · 2023-10-15 07:54 https://wiki.debian.org/fr/unattended-upgrades every night on all repo. with auto reboot enable at 4:00 am and use need restart and https://packages.debian.org/fr/sid/needrestart for reload outdated lib. for docker i use the latest tag and docker compose pull && docker compose up -d every day ---------------------------------------------------------------------- ffimnsr · 2023-10-15 08:07 Use terraform for setup and updates. It's also good to know that you can easily synchronize settings like its immutable ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-15 09:06 Been trying this with Packer to create Ubuntu VMs, but Auto Install seems to break with every minor release... worked great on 22.04v2, with 22.04.3 its bitching and failing 😔 ---------------------------------------------------------------------- dibu28 · 2023-10-15 09:08 Watchtower - for docker containers ---------------------------------------------------------------------- Nagashitw · 2023-10-15 12:04 The best one liner there is ---------------------------------------------------------------------- bufandatl · 2023-10-16 08:56 I even have an ansible playbook that runs once a week in my CI/CD to update OS packages. Some VMs are in an exclusion group because I need to update them manually but my monitoring will nag at me if there are a lot of patches available.