How you deal with security patching for Linux 2
will depend on the distribution that you use. 3
Now I recommend Debian as a general use 4
operating system for those who care about 5
security, privacy and anonymity. 6
For security patching I'm going to talk 7
about Debian and Debian based systems. 8
If you look here, you can see 9
all of the Debian derivatives here. 10
A lot of these are operating systems 11
that are important to security, 12
such as Kali, Tails, Whonix etc. 13
The Debian Project do an excellent job 14
of providing security updates for Debian. 15
Security is a priority for the Project 16
and for the operating system. 17
If you want to find the details 18
of the security issues related to the patches, 19
then have a look at the security update 20
page that Debian provides, which is here. 21
If we wander down to the bottom, 22
we can see all of the updates. 23
We can click on any of the updates 24
and find out more information about that particular update. 25
It can take us through to Mitre 26
and we can find out more on the CVE. 27
There's the details there, for the CVE. 28
We can see more details here. 29
And then we can follow the various sources 30
for more information here as well, 31
and potentially find even exploit code for it. 32
So as they say, they handle all security problems 33
brought to their attention 34
and ensure that they are corrected 35
within a reasonable time frame. 36
They also say that 37
many advisors are coordinated 38
with other free software vendors, 39
and are published the same day 40
a vulnerability is made public. 41
They also have an internal security 42
audit team that reviews the archive 43
looking for new or unfixed security bugs. 44
They also believe in public disclosure 45
and not security through obscurity, 46
in order to find security vulnerabilities which is great. 47
It's all good, 48
which is the reason why I recommend Debian 49
as the main go-to operating system 50
for general use when it comes to 51
security, privacy and anonymity. 52
How do we update Debian? 53
In Debian, 54
DPKG is the main package manager. 55
It's used to install, remove 56
and provide information about .deb packages. 57
This will be considered the lowest level tool 58
that other tools rely on to install packages. 59
So you’d issue a command, something like this. 60
If you want to install a Debian packages, 61
file name .deb would need to be 62
locally in your directory 63
in order for you to install it there. 64
There's also the advanced packaging tool 65
which is APT. 66
This is a command line front-end 67
for DPKG, for .deb and rpm packages. 68
An example of how you might use this 69
in order to do an install would be: 70
command here sudu apt-get install nmap. 71
Sudo is so that we can run under administrative privileges. 72
What this will do is this will install the nmap package 73
if it exists in the repository. 74
nmap's already installed 75
so it's not installed the newer version. 76
That was apt-get 77
but there are other apt commands as well, 78
which I’ll be showing you in a second. 79
We've shown DPKG, we've shown apt, 80
and now we're going to show aptitude. 81
Aptitude is a front-end 82
for the advanced packaging tool. 83
It's a front end for APT. 84
Let me quit this. 85
Very similar to apt-get, 86
this will install the zenmap package 87
if it's available within the repositories. 88
We're going to talk about what repositories are in a second. 89
That installs zenmap 90
and that will then appear as an application. 91
That's telling us that we can't do 92
all the things that we might want to do in zenmap, 93
unless we've got root privileges. 94
There's the application zenmap 95
that we've just downloaded and installed. 96
Okay, but what about software updates, 97
security updates? 98
To upgrade the operating system and the applications, 99
the commands that you will most often use are these: 100
and it's apt-get update 101
and it's apt-get dist-upgrade. 102
Let's run that. 103
The first thing it does 104
is run the apt-get update 105
and then it runs the dist-upgrade. 106
In this case there's nothing for it to upgrade. 107
If there was, it would simply 108
download them and install them. 109
Apt-get update first, let me explain that. 110
This is used to synchronize 111
the package index files from their source. 112
The indexes of available packages 113
are fetched from a location specified in this file here. 114
These are the sources here and here. 115
Here and here. 116
Here and here. 117
And these are not sources because they've been hashed out. 118
That's actually the CD-ROM. 119
If you had the CD-ROM, 120
it could actually get the files from there as well. 121
Apt-get update tells apt-get 122
if there had been any package changes. 123
An update must be performed first 124
so that apt-get knows that 125
new versions of packages are available 126
before you run the apt-get dist-upgrade. 127
Dist stands for distribution. 128
It's also possible to run this command as well. 129
We always need to run apt-get update, 130
but we can run apt-get upgrade 131
instead of apt-get dist-upgrade. 132
Let's go through the difference 133
between upgrade and dist-upgrade. 134
Upgrade is used to actually install 135
the newest versions of all packages 136
currently installed on the system 137
from the sources enumerated in here. 138
Packages currently installed 139
with new versions available 140
are retrieved and upgraded. 141
Under no circumstances 142
are currently installed packages removed 143
or packages not already installed, retrieved and installed. 144
New versions of currently installed packages 145
that cannot be upgraded without changing 146
the install status of another package 147
will be left at their current version. 148
Now, dist-upgrade is slightly different. 149
In addition to performing the function of upgrade, 150
it also intelligently handles 151
changing dependencies with new versions of packages. 152
Apt-get has a small conflict resolution system 153
and it will attempt to upgrade the most important packages 154
at the expense of less important ones if necessary. 155
Dist-upgrade command may remove some packages. 156
And the sources.list file contains 157
the list of locations from which to retrieve 158
desired package files. 159
Therefore, this is a good option 160
for updating and upgrading your distribution 161
and would be the command that I recommend 162
for Debian and KALI. 163
If you remember, we also mentioned aptitude. 164
Aptitude can be used as well 165
to upgrade and update, 166
and you would just substitute 167
the command aptitude with apt-get. 168
This is the recommended way of doing it by Debian. 169
I just prefer the apt-get 170
way of doing it because I prefer the output, 171
but this can also be used. 172
There're also some GUI tools that you can use. 173
Synaptic, which will need to be run 174
as an administrator or root, 175
has a GUI front-end for the package manager, 176
you can see here for example 177
the repositories that we mentioned before. 178
Also Package Updater and Packages. 179
You can see that's packages. 180
You can look for things that are installed 181
and things that are available. 182
Package Updater will, as the name suggests, 183
look for updates and enable you to install them. 184
It is possible to setup automatic updates 185
for Debian and automatic updates 186
for security updates, specifically. 187
There are a number of different methods you can use 188
so it's really down to you, what you want to do. 189
Check out this page if you want some more details 190
on the various options on what it is you want to do. 191
There's four main options: 192
you can use the GNOME update manager, 193
you can use the unattended upgrades package, 194
you can write your own cron script 195
that calls aptitude or apt-get, 196
and you can use cron apt. 197
You can see here this details the various methods. 198
This is a method I tend to use 199
and I can show you simply how I do that. 200
First thing is, we need to install unattended upgrades. 201
Then we want to edit the 10 periodic file. 202
You can do that with your favorite text editor. 203
I'm using gedit here. 204
This is what you need to be in this file 205
and then you need to save it. 206
Let me show you these a little bit bigger. 207
There you go, so that's what you need in that file. 208
You also need to edit this file here, 209
50 unattended upgrades. 210
If I remove these here, 211
this will automatically update the security updates. 212
You can change some of these to update, 213
some of the other options, but for here, 214
I'm just showing you the security updates. 215
You can make your own decision on the other updates. 216
And if you save that, 217
you should be good to go for automatic updates.