[{"data":1,"prerenderedAt":839},["ShallowReactive",2],{"guide-\u002Fguides\u002Fcyber-essentials-14-day-patching-linux":3,"mdc-pre:3rsjwTMeoW4yXCEMNM-lBisoXbV8BY51IbbsdjpMoe0":826,"mdc-pre:0mMD9JTxxHtXrTmnhX5Y-CGPZEzD14N8sz5-qVji1vk":827,"mdc-pre:uXsCe1D05FKV5pVGl0yy57HjxTIs4RmmgujRluH-8z0":828,"mdc-pre:umlAYfA0CimQE_XO0nUp3upnlt7RGIoysCpNRj9xNDM":829,"mdc-pre:_WK_OiU_eWgUdMWSXzARD1FGKTlQ4KHWo0xT1ubnPaY":830,"mdc-pre:674ahUIIcl0KcqRLSH0yqjQWj7AUqEo1buYBs2P8x0U":831,"mdc-pre:zBUgrMWwXFYAl6G4VXozT0PivOh3fpb3VjqWH19yE2w":832,"mdc-pre:bp7kFx1eYheO8uOGLdSnaGQxGx65jtL6p1AAwIY4Ggk":833,"mdc-pre:Es1sbCQD-rZTzFbFGKhNr2dRZRi9sy0skQqlUdc1nC4":834,"mdc-pre:MvcMNz6FQetTr2xtrOjVLQRfQGcazE1S8QyqUbwOCiU":835,"mdc-pre:2nhWBKfb81J2Hurh0LiZzGNSH5N5cr6E452JScT_-Ck":836,"mdc-pre:cnkj0Y_5Ec4i2C2jQQwQCc8T_z526n5LXPDQtCbT5_M":837,"mdc-pre:JCp2xwz5IytOJfd6ig5DcQUPxGeD_BNpfSxmTy0HYqM":838},{"id":4,"title":5,"body":6,"date":809,"description":810,"draft":811,"extension":812,"featured":811,"keyTakeaway":813,"meta":814,"navigation":513,"path":815,"primaryKeyword":816,"seo":817,"service":818,"stem":819,"tags":820,"__hash__":825},"guides\u002Fguides\u002Fcyber-essentials-14-day-patching-linux.md","Cyber Essentials 14-day patching rule for Linux servers",{"type":7,"value":8,"toc":789},"minimark",[9,13,17,22,25,29,40,57,60,63,67,76,87,95,98,101,105,110,149,156,189,204,208,222,229,233,262,269,287,306,310,314,361,364,380,384,400,407,429,432,463,466,470,473,476,534,545,556,560,563,636,639,661,665,671,685,691,741,744,750,754,757,774,778,785],[10,11,5],"h1",{"id":12},"cyber-essentials-14-day-patching-rule-for-linux-servers",[14,15,16],"p",{},"For small UK tech firms and agencies with a handful of Linux servers or VPSs, preparing for Cyber Essentials and wondering what the patching rule means in practice.",[18,19,21],"h2",{"id":20},"key-takeaway","Key takeaway",[14,23,24],{},"Since the April 2026 changes, missing high-risk or critical updates within 14 days of release is an automatic fail. On Linux that means: know every server you run, check security updates at least weekly, apply them automatically where you can, reboot for kernel fixes, and keep dated records that prove it.",[18,26,28],{"id":27},"what-changed-in-april-2026","What changed in April 2026",[14,30,31,32,39],{},"IASME's ",[33,34,38],"a",{"href":35,"rel":36},"https:\u002F\u002Fiasme.co.uk\u002Farticles\u002Fimportant-update-changes-to-cyber-essentials-for-april-2026\u002F",[37],"nofollow","February 2026 update on the scheme changes"," lists two security update questions that are now \"auto-fail\":",[41,42,43,51],"ul",{},[44,45,46,50],"li",{},[47,48,49],"strong",{},"A6.4:"," are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?",[44,52,53,56],{},[47,54,55],{},"A6.5:"," the same question for applications, including associated files and extensions.",[14,58,59],{},"Failing either one fails the whole assessment, however well you do elsewhere. IASME says the changes apply to assessment accounts created after 26 April 2026, alongside Requirements for IT Infrastructure v3.3 and the new Danzell question set. If your account was created before that date, you have six months to get certified using the previous version of the requirements.",[14,61,62],{},"IASME also says the \"point in time\" for the assessment is the date the certificate is issued, so your systems must be supported on that date. And the director's declaration now confirms you'll stay compliant for the whole certification period, not just on assessment day.",[18,64,66],{"id":65},"what-counts-as-high-risk-or-critical","What counts as high-risk or critical",[14,68,69,70,75],{},"The NCSC's ",[33,71,74],{"href":72,"rel":73},"https:\u002F\u002Fwww.ncsc.gov.uk\u002Ffiles\u002Fcyber-essentials-requirements-for-it-infrastructure-v3-3.pdf",[37],"Cyber Essentials: Requirements for IT Infrastructure v3.3"," says in-scope software must be licensed and supported, have automatic updates turned on where possible, and be updated within 14 days of release where:",[41,77,78,81,84],{},[44,79,80],{},"the vendor describes the vulnerabilities as \"critical\" or \"high risk\"",[44,82,83],{},"the vulnerabilities have a CVSS v3 base score of 7 or above",[44,85,86],{},"the vendor gives no details about how severe the vulnerabilities are",[14,88,89,90,94],{},"If an update fixes several issues and any one of them is critical or high risk, the whole update has to go on within 14 days. The NCSC also recommends, though it isn't mandatory, applying ",[91,92,93],"em",{},"all"," updates within 14 days.",[14,96,97],{},"On Linux, vendor terms vary. Red Hat-family distributions use Critical, Important, Moderate and Low. Ubuntu and Debian publish priorities in their security notices and trackers. If you're unsure, use the CVSS score, or treat the update as in scope. The 14 days start when the vendor releases the fix, not when your scanner first notices it.",[14,99,100],{},"The simplest approach on a server is to install every security update within 14 days, rather than sorting them one by one.",[18,102,104],{"id":103},"debian-and-ubuntu","Debian and Ubuntu",[106,107,109],"h3",{"id":108},"see-pending-updates","See pending updates",[111,112,117],"pre",{"className":113,"code":114,"language":115,"meta":116,"style":116},"language-bash shiki shiki-themes github-dark","sudo apt update\napt list --upgradable\n","bash","",[118,119,120,136],"code",{"__ignoreMap":116},[121,122,125,129,133],"span",{"class":123,"line":124},"line",1,[121,126,128],{"class":127},"svObZ","sudo",[121,130,132],{"class":131},"sU2Wk"," apt",[121,134,135],{"class":131}," update\n",[121,137,139,142,145],{"class":123,"line":138},2,[121,140,141],{"class":127},"apt",[121,143,144],{"class":131}," list",[121,146,148],{"class":147},"sDLfK"," --upgradable\n",[14,150,151,152,155],{},"On Ubuntu, security fixes come from the ",[118,153,154],{},"-security"," pocket, so you can filter for them:",[111,157,159],{"className":113,"code":158,"language":115,"meta":116,"style":116},"apt list --upgradable 2>\u002Fdev\u002Fnull | grep -- '-security'\n",[118,160,161],{"__ignoreMap":116},[121,162,163,165,167,170,174,177,180,183,186],{"class":123,"line":124},[121,164,141],{"class":127},[121,166,144],{"class":131},[121,168,169],{"class":147}," --upgradable",[121,171,173],{"class":172},"snl16"," 2>",[121,175,176],{"class":131},"\u002Fdev\u002Fnull",[121,178,179],{"class":172}," |",[121,181,182],{"class":127}," grep",[121,184,185],{"class":147}," --",[121,187,188],{"class":131}," '-security'\n",[14,190,191,192,195,196,199,200,203],{},"On Debian, security updates come from the ",[118,193,194],{},"security.debian.org"," (",[118,197,198],{},"bookworm-security",", ",[118,201,202],{},"trixie-security",") suite. Check that it's in your sources, then use the same listing.",[106,205,207],{"id":206},"apply-them","Apply them",[111,209,211],{"className":113,"code":210,"language":115,"meta":116,"style":116},"sudo apt upgrade\n",[118,212,213],{"__ignoreMap":116},[121,214,215,217,219],{"class":123,"line":124},[121,216,128],{"class":127},[121,218,132],{"class":131},[121,220,221],{"class":131}," upgrade\n",[14,223,224,225,228],{},"Use ",[118,226,227],{},"sudo apt full-upgrade"," when an update needs to add or remove packages, for example new kernel packages on some releases. Check what it plans to remove before you confirm.",[106,230,232],{"id":231},"automate-with-unattended-upgrades","Automate with unattended-upgrades",[111,234,236],{"className":113,"code":235,"language":115,"meta":116,"style":116},"sudo apt install unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n",[118,237,238,250],{"__ignoreMap":116},[121,239,240,242,244,247],{"class":123,"line":124},[121,241,128],{"class":127},[121,243,132],{"class":131},[121,245,246],{"class":131}," install",[121,248,249],{"class":131}," unattended-upgrades\n",[121,251,252,254,257,260],{"class":123,"line":138},[121,253,128],{"class":127},[121,255,256],{"class":131}," dpkg-reconfigure",[121,258,259],{"class":147}," -plow",[121,261,249],{"class":131},[14,263,264,265,268],{},"This turns on the daily periodic job in ",[118,266,267],{},"\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F20auto-upgrades",". By default it installs updates from the security origin only. To check what it would do:",[111,270,272],{"className":113,"code":271,"language":115,"meta":116,"style":116},"sudo unattended-upgrade --dry-run --debug\n",[118,273,274],{"__ignoreMap":116},[121,275,276,278,281,284],{"class":123,"line":124},[121,277,128],{"class":127},[121,279,280],{"class":131}," unattended-upgrade",[121,282,283],{"class":147}," --dry-run",[121,285,286],{"class":147}," --debug\n",[14,288,289,290,293,294,297,298,301,302,305],{},"It logs to ",[118,291,292],{},"\u002Fvar\u002Flog\u002Funattended-upgrades\u002F",". If a server must reboot itself at a set time, look at ",[118,295,296],{},"Unattended-Upgrade::Automatic-Reboot"," and ",[118,299,300],{},"Automatic-Reboot-Time"," in ",[118,303,304],{},"\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F50unattended-upgrades",".",[18,307,309],{"id":308},"rhel-rocky-linux-and-almalinux","RHEL, Rocky Linux and AlmaLinux",[106,311,313],{"id":312},"see-pending-security-updates","See pending security updates",[111,315,317],{"className":113,"code":316,"language":115,"meta":116,"style":116},"sudo dnf updateinfo list --security\nsudo dnf updateinfo list --sec-severity=Critical\nsudo dnf updateinfo list --sec-severity=Important\n",[118,318,319,334,347],{"__ignoreMap":116},[121,320,321,323,326,329,331],{"class":123,"line":124},[121,322,128],{"class":127},[121,324,325],{"class":131}," dnf",[121,327,328],{"class":131}," updateinfo",[121,330,144],{"class":131},[121,332,333],{"class":147}," --security\n",[121,335,336,338,340,342,344],{"class":123,"line":138},[121,337,128],{"class":127},[121,339,325],{"class":131},[121,341,328],{"class":131},[121,343,144],{"class":131},[121,345,346],{"class":147}," --sec-severity=Critical\n",[121,348,350,352,354,356,358],{"class":123,"line":349},3,[121,351,128],{"class":127},[121,353,325],{"class":131},[121,355,328],{"class":131},[121,357,144],{"class":131},[121,359,360],{"class":147}," --sec-severity=Important\n",[106,362,207],{"id":363},"apply-them-1",[111,365,367],{"className":113,"code":366,"language":115,"meta":116,"style":116},"sudo dnf upgrade --security\n",[118,368,369],{"__ignoreMap":116},[121,370,371,373,375,378],{"class":123,"line":124},[121,372,128],{"class":127},[121,374,325],{"class":131},[121,376,377],{"class":131}," upgrade",[121,379,333],{"class":147},[106,381,383],{"id":382},"automate-with-dnf-automatic","Automate with dnf-automatic",[111,385,387],{"className":113,"code":386,"language":115,"meta":116,"style":116},"sudo dnf install dnf-automatic\n",[118,388,389],{"__ignoreMap":116},[121,390,391,393,395,397],{"class":123,"line":124},[121,392,128],{"class":127},[121,394,325],{"class":131},[121,396,246],{"class":131},[121,398,399],{"class":131}," dnf-automatic\n",[14,401,402,403,406],{},"In ",[118,404,405],{},"\u002Fetc\u002Fdnf\u002Fautomatic.conf",", set:",[111,408,412],{"className":409,"code":410,"language":411,"meta":116,"style":116},"language-ini shiki shiki-themes github-dark","[commands]\nupgrade_type = security\napply_updates = yes\n","ini",[118,413,414,419,424],{"__ignoreMap":116},[121,415,416],{"class":123,"line":124},[121,417,418],{},"[commands]\n",[121,420,421],{"class":123,"line":138},[121,422,423],{},"upgrade_type = security\n",[121,425,426],{"class":123,"line":349},[121,427,428],{},"apply_updates = yes\n",[14,430,431],{},"Then turn on the timer:",[111,433,435],{"className":113,"code":434,"language":115,"meta":116,"style":116},"sudo systemctl enable --now dnf-automatic.timer\nsystemctl list-timers dnf-automatic.timer\n",[118,436,437,453],{"__ignoreMap":116},[121,438,439,441,444,447,450],{"class":123,"line":124},[121,440,128],{"class":127},[121,442,443],{"class":131}," systemctl",[121,445,446],{"class":131}," enable",[121,448,449],{"class":147}," --now",[121,451,452],{"class":131}," dnf-automatic.timer\n",[121,454,455,458,461],{"class":123,"line":138},[121,456,457],{"class":127},"systemctl",[121,459,460],{"class":131}," list-timers",[121,462,452],{"class":131},[14,464,465],{},"(This is the dnf 4 setup used on RHEL 8 and 9 and their rebuilds. Newer dnf5-based releases package it differently, so check your distribution's docs.)",[18,467,469],{"id":468},"kernel-updates-reboots-and-live-patching","Kernel updates, reboots and live patching",[14,471,472],{},"A new kernel doesn't protect you until the server is running it. Installed but not booted doesn't count as patched in any useful sense.",[14,474,475],{},"Check whether a reboot is needed:",[111,477,479],{"className":113,"code":478,"language":115,"meta":116,"style":116},"# Ubuntu (and Debian where the flag is created)\nls \u002Fvar\u002Frun\u002Freboot-required 2>\u002Fdev\u002Fnull && cat \u002Fvar\u002Frun\u002Freboot-required.pkgs\n\n# RHEL family (dnf-plugins-core)\nsudo dnf needs-restarting -r\n",[118,480,481,487,509,515,521],{"__ignoreMap":116},[121,482,483],{"class":123,"line":124},[121,484,486],{"class":485},"sAwPA","# Ubuntu (and Debian where the flag is created)\n",[121,488,489,492,495,497,499,503,506],{"class":123,"line":138},[121,490,491],{"class":127},"ls",[121,493,494],{"class":131}," \u002Fvar\u002Frun\u002Freboot-required",[121,496,173],{"class":172},[121,498,176],{"class":131},[121,500,502],{"class":501},"s95oV"," && ",[121,504,505],{"class":127},"cat",[121,507,508],{"class":131}," \u002Fvar\u002Frun\u002Freboot-required.pkgs\n",[121,510,511],{"class":123,"line":349},[121,512,514],{"emptyLinePlaceholder":513},true,"\n",[121,516,518],{"class":123,"line":517},4,[121,519,520],{"class":485},"# RHEL family (dnf-plugins-core)\n",[121,522,524,526,528,531],{"class":123,"line":523},5,[121,525,128],{"class":127},[121,527,325],{"class":131},[121,529,530],{"class":131}," needs-restarting",[121,532,533],{"class":147}," -r\n",[14,535,536,537,540,541,544],{},"Compare ",[118,538,539],{},"uname -r"," with the newest kernel package installed. The ",[118,542,543],{},"needrestart"," package on Debian and Ubuntu also shows which services are still running old libraries after an update.",[14,546,547,548,551,552,555],{},"Live patching can close the gap between reboots for some kernel fixes. On Ubuntu, Canonical Livepatch comes with Ubuntu Pro (",[118,549,550],{},"sudo pro enable livepatch",", then ",[118,553,554],{},"canonical-livepatch status","). On RHEL, kpatch is available through Red Hat subscriptions. Live patches don't cover every fix, so you still need to plan reboots. A scheduled monthly reboot window, plus extra reboots for urgent kernel fixes, works for most small estates.",[18,557,559],{"id":558},"keep-evidence-of-patch-dates","Keep evidence of patch dates",[14,561,562],{},"You may need to show when updates went on. Linux already records this, so keep the records and don't let them rotate away:",[111,564,566],{"className":113,"code":565,"language":115,"meta":116,"style":116},"# Debian\u002FUbuntu: what was installed and when\nzgrep -h -E '^(Start-Date|Upgrade|Install):' \u002Fvar\u002Flog\u002Fapt\u002Fhistory.log*\n\n# RHEL family\nsudo dnf history\nsudo dnf history info \u003CID>\n",[118,567,568,573,593,597,602,611],{"__ignoreMap":116},[121,569,570],{"class":123,"line":124},[121,571,572],{"class":485},"# Debian\u002FUbuntu: what was installed and when\n",[121,574,575,578,581,584,587,590],{"class":123,"line":138},[121,576,577],{"class":127},"zgrep",[121,579,580],{"class":147}," -h",[121,582,583],{"class":147}," -E",[121,585,586],{"class":131}," '^(Start-Date|Upgrade|Install):'",[121,588,589],{"class":131}," \u002Fvar\u002Flog\u002Fapt\u002Fhistory.log",[121,591,592],{"class":147},"*\n",[121,594,595],{"class":123,"line":349},[121,596,514],{"emptyLinePlaceholder":513},[121,598,599],{"class":123,"line":517},[121,600,601],{"class":485},"# RHEL family\n",[121,603,604,606,608],{"class":123,"line":523},[121,605,128],{"class":127},[121,607,325],{"class":131},[121,609,610],{"class":131}," history\n",[121,612,614,616,618,621,624,627,630,633],{"class":123,"line":613},6,[121,615,128],{"class":127},[121,617,325],{"class":131},[121,619,620],{"class":131}," history",[121,622,623],{"class":131}," info",[121,625,626],{"class":172}," \u003C",[121,628,629],{"class":131},"I",[121,631,632],{"class":501},"D",[121,634,635],{"class":172},">\n",[14,637,638],{},"Practical habits:",[41,640,641,644,647,658],{},[44,642,643],{},"Keep a simple asset list: hostname, provider, OS and version, end-of-support date, owner.",[44,645,646],{},"Once a month, export the update history and the output of the pending-updates command for each server, and store it outside the server itself.",[44,648,649,650,653,654,657],{},"Note the date of each kernel reboot (",[118,651,652],{},"last reboot"," or ",[118,655,656],{},"uptime -s",").",[44,659,660],{},"Write down your process in a few lines: how often you check, what's automatic, who reboots, and when.",[18,662,664],{"id":663},"common-gaps","Common gaps",[14,666,667,670],{},[47,668,669],{},"Forgotten VPSs."," The staging box, the old client site, the test droplet someone made two years ago. If it's in scope, it needs patching. If it isn't needed, switch it off. Check every provider account, not just the main one.",[14,672,673,676,677,680,681,684],{},[47,674,675],{},"Unsupported OS releases."," If a release is past end of support, no security fixes arrive, so you can't meet the requirement. Check ",[118,678,679],{},"\u002Fetc\u002Fos-release"," against the vendor's lifecycle page. For Ubuntu LTS releases past standard support, Expanded Security Maintenance through Ubuntu Pro may keep them supported (",[118,682,683],{},"pro status"," shows coverage). Otherwise, plan the upgrade or migration well before your certificate date.",[14,686,687,690],{},[47,688,689],{},"Container base images."," Updating the host doesn't update the software inside your containers. Rebuild images regularly from a current, supported base and redeploy:",[111,692,694],{"className":113,"code":693,"language":115,"meta":116,"style":116},"docker build --pull --no-cache -t myapp:latest .\ndocker compose pull && docker compose up -d\n",[118,695,696,719],{"__ignoreMap":116},[121,697,698,701,704,707,710,713,716],{"class":123,"line":124},[121,699,700],{"class":127},"docker",[121,702,703],{"class":131}," build",[121,705,706],{"class":147}," --pull",[121,708,709],{"class":147}," --no-cache",[121,711,712],{"class":147}," -t",[121,714,715],{"class":131}," myapp:latest",[121,717,718],{"class":131}," .\n",[121,720,721,723,726,729,731,733,735,738],{"class":123,"line":138},[121,722,700],{"class":127},[121,724,725],{"class":131}," compose",[121,727,728],{"class":131}," pull",[121,730,502],{"class":501},[121,732,700],{"class":127},[121,734,725],{"class":131},[121,736,737],{"class":131}," up",[121,739,740],{"class":147}," -d\n",[14,742,743],{},"Pin to supported base image tags. Old tags such as an end-of-life Debian or Alpine version quietly stop getting fixes.",[14,745,746,749],{},[47,747,748],{},"Software outside the package manager."," Tarball installs, vendored binaries, language runtimes and third-party repositories sit outside the commands above. A6.5 covers applications too, so list these and track their updates.",[18,751,753],{"id":752},"where-i-can-help","Where I can help",[14,755,756],{},"I'm a Linux server support and security freelancer, and I was previously Head of Professional Services at CrowdSec. I help firms put the patching process, automation and evidence in place to meet the 14-day rule. I'm not a certification body and I don't carry out Cyber Essentials assessments.",[41,758,759,767],{},[44,760,761,762,766],{},"A ",[33,763,765],{"href":764},"\u002Flinux-server-security-review","Linux server security review"," (from £295 per server) checks update configuration, OS support status, reboot gaps, exposed services and evidence, and gives you a prioritised fix list.",[44,768,769,773],{},[33,770,772],{"href":771},"\u002Flinux-server-support#ongoing-support","Ongoing Linux server support"," (from £195\u002Fmonth) includes up to two support hours a month for checking updates, reboots and keeping records up to date. It doesn't include monitoring or 24\u002F7 cover.",[18,775,777],{"id":776},"practical-next-step","Practical next step",[14,779,780,781,305],{},"List every Linux server you run, run the pending-security-updates command on each one this week, and turn on automatic security updates where it's safe to do so. If you'd like a second pair of eyes, ",[33,782,784],{"href":783},"\u002Fcontact","book a free call",[786,787,788],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}",{"title":116,"searchDepth":138,"depth":138,"links":790},[791,792,793,794,799,804,805,806,807,808],{"id":20,"depth":138,"text":21},{"id":27,"depth":138,"text":28},{"id":65,"depth":138,"text":66},{"id":103,"depth":138,"text":104,"children":795},[796,797,798],{"id":108,"depth":349,"text":109},{"id":206,"depth":349,"text":207},{"id":231,"depth":349,"text":232},{"id":308,"depth":138,"text":309,"children":800},[801,802,803],{"id":312,"depth":349,"text":313},{"id":363,"depth":349,"text":207},{"id":382,"depth":349,"text":383},{"id":468,"depth":138,"text":469},{"id":558,"depth":138,"text":559},{"id":663,"depth":138,"text":664},{"id":752,"depth":138,"text":753},{"id":776,"depth":138,"text":777},"2026-10-12","How to meet the Cyber Essentials 14-day patching rule on Linux servers, with apt and dnf commands, automatic updates, kernel reboots and patch evidence.",false,"md",null,{},"\u002Fguides\u002Fcyber-essentials-14-day-patching-linux","cyber essentials 14 day patching linux",{"title":5,"description":810},"security-review","guides\u002Fcyber-essentials-14-day-patching-linux",[821,822,823,824],"cyber-essentials","patching","linux","security","j5ACOQC77Tn406QBIQWw1EX8nPEQYbv3V0glQCvtsG4","\u003Cspan class=\"line\" line=\"1\">\u003Cspan>[commands]\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan>upgrade_type = security\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"3\">\u003Cspan>apply_updates = yes\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> apt\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> update\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">apt\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --upgradable\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">apt\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --upgradable\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\"> 2>\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\">\u002Fdev\u002Fnull\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\"> |\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#B392F0\"> grep\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> '-security'\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> apt\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> upgrade\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> apt\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> install\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> unattended-upgrades\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dpkg-reconfigure\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -plow\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> unattended-upgrades\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> unattended-upgrade\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --dry-run\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --debug\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> updateinfo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --security\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> updateinfo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --sec-severity=Critical\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"3\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> updateinfo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --sec-severity=Important\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> upgrade\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --security\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> install\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf-automatic\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> systemctl\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> enable\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --now\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf-automatic.timer\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">systemctl\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> list-timers\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf-automatic.timer\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#6A737D\"># Ubuntu (and Debian where the flag is created)\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">ls\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> \u002Fvar\u002Frun\u002Freboot-required\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\"> 2>\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\">\u002Fdev\u002Fnull\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#E1E4E8\"> && \u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#B392F0\">cat\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> \u002Fvar\u002Frun\u002Freboot-required.pkgs\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"3\">\u003Cspan emptyLinePlaceholder>\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"4\">\u003Cspan style=\"--shiki-default:#6A737D\"># RHEL family (dnf-plugins-core)\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"5\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> needs-restarting\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -r\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#6A737D\"># Debian\u002FUbuntu: what was installed and when\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">zgrep\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -h\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -E\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> '^(Start-Date|Upgrade|Install):'\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> \u002Fvar\u002Flog\u002Fapt\u002Fhistory.log\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\">*\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"3\">\u003Cspan emptyLinePlaceholder>\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"4\">\u003Cspan style=\"--shiki-default:#6A737D\"># RHEL family\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"5\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> history\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"6\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> dnf\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> history\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> info\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\"> <\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\">I\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#E1E4E8\">D\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\">>\u003C\u002Fspan>\u003C\u002Fspan>","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">docker\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> build\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --pull\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> --no-cache\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -t\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> myapp:latest\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> .\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">docker\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> compose\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> pull\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#E1E4E8\"> && \u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#B392F0\">docker\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> compose\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> up\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -d\u003C\u002Fspan>\u003C\u002Fspan>",1792571462172]