How do you know wether your Linux server (which has no desktop update notifier or unattended security updates running) does need to be updated? Of course an
apt-get update && apt-get --dry-run upgrademight give an indication. But what of the package upgrades do stand for security risks and whose are only simple bugfixes you do not care about?
Check using APTOne useful possibility is apticron which will tell you which packages should be upgraded and why. It presents you the package ChangeLog to decided wether you want to upgrade a package or not. Similar but less details is cron-apt which also informs you of new package updates.
Analyze Security AdvisoriesNow with all those CERT newsletters, security mailing lists and even security news feeds out there: why can't we check the other way around? Why not find out:
- Which security advisories do affect my system?
- Which ones I have already complied with?
- And which vulnerabilities are still there?