How you deal with security patching for Linux
will depend on the distribution that you use.
Now I recommend Debian as a general use
operating system for those who care about
security, privacy and anonymity.
For security patching I'm going to talk
about Debian and Debian based systems.
If you look here, you can see
all of the Debian derivatives here.
A lot of these are operating systems
that are important to security,
such as Kali, Tails, Whonix etc.
The Debian Project do an excellent job
of providing security updates for Debian.
Security is a priority for the Project
and for the operating system.
If you want to find the details
of the security issues related to the patches,
then have a look at the security update
page that Debian provides, which is here.
If we wander down to the bottom,
we can see all of the updates.
We can click on any of the updates
and find out more information about that particular update.
It can take us through to Mitre
and we can find out more on the CVE.
There's the details there, for the CVE.
We can see more details here.
And then we can follow the various sources
for more information here as well,
and potentially find even exploit code for it.
So as they say, they handle all security problems
brought to their attention
and ensure that they are corrected
within a reasonable time frame.
They also say that
many advisors are coordinated
with other free software vendors,
and are published the same day
a vulnerability is made public.
They also have an internal security
audit team that reviews the archive
looking for new or unfixed security bugs.
They also believe in public disclosure
and not security through obscurity,
in order to find security vulnerabilities which is great.
It's all good,
which is the reason why I recommend Debian
as the main go-to operating system
for general use when it comes to
security, privacy and anonymity.
How do we update Debian?
In Debian,
DPKG is the main package manager.
It's used to install, remove
and provide information about .deb packages.
This will be considered the lowest level tool
that other tools rely on to install packages.
So you’d issue a command, something like this.
If you want to install a Debian packages,
file name .deb would need to be
locally in your directory
in order for you to install it there.
There's also the advanced packaging tool
which is APT.
This is a command line front-end
for DPKG, for .deb and rpm packages.
An example of how you might use this
in order to do an install would be:
command here sudu apt-get install nmap.
Sudo is so that we can run under administrative privileges.
What this will do is this will install the nmap package
if it exists in the repository.
nmap's already installed
so it's not installed the newer version.
That was apt-get
but there are other apt commands as well,
which I’ll be showing you in a second.
We've shown DPKG, we've shown apt,
and now we're going to show aptitude.
Aptitude is a front-end
for the advanced packaging tool.
It's a front end for APT.
Let me quit this.
Very similar to apt-get,
this will install the zenmap package
if it's available within the repositories.
We're going to talk about what repositories are in a second.
That installs zenmap
and that will then appear as an application.
That's telling us that we can't do
all the things that we might want to do in zenmap,
unless we've got root privileges.
There's the application zenmap
that we've just downloaded and installed.
Okay, but what about software updates,
security updates?
To upgrade the operating system and the applications,
the commands that you will most often use are these:
and it's apt-get update
and it's apt-get dist-upgrade.
Let's run that.
The first thing it does
is run the apt-get update
and then it runs the dist-upgrade.
In this case there's nothing for it to upgrade.
If there was, it would simply
download them and install them.
Apt-get update first, let me explain that.
This is used to synchronize
the package index files from their source.
The indexes of available packages
are fetched from a location specified in this file here.
These are the sources here and here.
Here and here.
And these are not sources because they've been hashed out.
That's actually the CD-ROM.
If you had the CD-ROM,
it could actually get the files from there as well.
Apt-get update tells apt-get
if there had been any package changes.
An update must be performed first
so that apt-get knows that
new versions of packages are available
before you run the apt-get dist-upgrade.
Dist stands for distribution.
It's also possible to run this command as well.
We always need to run apt-get update,
but we can run apt-get upgrade
instead of apt-get dist-upgrade.
Let's go through the difference
between upgrade and dist-upgrade.
Upgrade is used to actually install
the newest versions of all packages
currently installed on the system
from the sources enumerated in here.
Packages currently installed
with new versions available
are retrieved and upgraded.
Under no circumstances
are currently installed packages removed
or packages not already installed, retrieved and installed.
New versions of currently installed packages
that cannot be upgraded without changing
the install status of another package
will be left at their current version.
Now, dist-upgrade is slightly different.
In addition to performing the function of upgrade,
it also intelligently handles
changing dependencies with new versions of packages.
Apt-get has a small conflict resolution system
and it will attempt to upgrade the most important packages
at the expense of less important ones if necessary.
Dist-upgrade command may remove some packages.
And the sources.list file contains
the list of locations from which to retrieve
desired package files.
Therefore, this is a good option
for updating and upgrading your distribution
and would be the command that I recommend
for Debian and KALI.
If you remember, we also mentioned aptitude.
Aptitude can be used as well
to upgrade and update,
and you would just substitute
the command aptitude with apt-get.
This is the recommended way of doing it by Debian.
I just prefer the apt-get
way of doing it because I prefer the output,
but this can also be used.
There're also some GUI tools that you can use.
Synaptic, which will need to be run
as an administrator or root,
has a GUI front-end for the package manager,
you can see here for example
the repositories that we mentioned before.
Also Package Updater and Packages.
You can see that's packages.
You can look for things that are installed
and things that are available.
Package Updater will, as the name suggests,
look for updates and enable you to install them.
It is possible to setup automatic updates
for Debian and automatic updates
for security updates, specifically.
There are a number of different methods you can use
so it's really down to you, what you want to do.
Check out this page if you want some more details
on the various options on what it is you want to do.
There's four main options:
you can use the GNOME update manager,
you can use the unattended upgrades package,
you can write your own cron script
that calls aptitude or apt-get,
and you can use cron apt.
You can see here this details the various methods.
This is a method I tend to use
and I can show you simply how I do that.
First thing is, we need to install unattended upgrades.
Then we want to edit the 10 periodic file.
You can do that with your favorite text editor.
I'm using gedit here.
This is what you need to be in this file
and then you need to save it.
Let me show you these a little bit bigger.
There you go, so that's what you need in that file.
You also need to edit this file here,
50 unattended upgrades.
If I remove these here,
this will automatically update the security updates.
You can change some of these to update,
some of the other options, but for here,
I'm just showing you the security updates.
You can make your own decision on the other updates.
And if you save that,
you should be good to go for automatic updates.