To learn a bit of server administration I've set up a simple Ubuntu 14.04 server on which I run a personal website. I've set it to automatically install security updates, but leave out the other updates. This seems to work pretty fine. Occasionally I get a message when logging into the server (with ssh) saying:
*** System restart required ***
The times this happened I simple rebooted Ubuntu and all was fine. This is ok because it's a simple personal website. What I wonder about though, is how this works for webservers which should be up 99.9999etc% of the time? Do they simply not restart and risk the security being breached because security updates are not installed (which I cannot imagine)? Or do they take the downtime for granted (which I cannot imagine either)?
How should I handle this if this were a very important production server which I want to keep up and running? All tips are welcome!
I know I can do
cat /var/run/reboot-required.pkgs to list the packages which cause the reboot. The command currently yields the following:
linux-image-3.13.0-36-generic linux-base dbus linux-image-extra-3.13.0-36-generic linux-base
but how do I know if the updates are little things of whether I have a serious security vulnerability if I don't do the restart?
[EDIT2] Okay, I now combined the commands I've found to be useful into one:
xargs aptitude changelog < /var/run/reboot-required.pkgs | grep urgency=high
If this doesn't output anything, there don't seem to be security issues with a high urgency.
One last question though: are
high the only urgency possibilities, or are there any more like for example
| grep 'urgency=' | egrep -v '=(low|medium)'