Btw, to keep a server secure, we need to constantly keep updating and patching the software. Like how Microsoft Windows is releasing Windows updates every month, and urgent security updates more frequently.
How are RHEL/CentOS and Debian handling this?
Do they automatically check, download and install any updates without an administrator logging in to run yum update or apt-get update? I supposed this can be done via a cron job of some kind?
From real world experience, do they ever get into trouble after an update like software breaking, or missing dependencies? I heard yum is worse than apt-get at figuring out all the necessary dependencies. Conversely, apt-get/aptitude is usually safer and get the job done.
RHEL/CentOS is also deficient in handling OS upgrade, and recommends a clean re-install if OS upgrade is desired. I heard Debian is able to upgrade OS version and kernel more smoothly with aptitude/apt-get.
From reading around, I am leaning more towards Debian, but wanting to heard feedbacks from real world experience.
Security patches are made available to Linux distro via their repository, so you can always update using yum in Redhat-based system, apt-get using Debian based system, pacman for Arch or yast2 for SuSE.
All these years using Linux, I haven't really encounter any specific cases where such security updates crash or crippled a system. But you do find prudent system administrators tend to disable automatic security patches update, or even if they were to perform any manual security patches, they will first backup the environments, do it on the staging environment, test out the functionality of the applications or system, then proceed the same on the production environment. If you value your rice bowl, you will do this no matter how safe the process is. The same should be for any platforms even for Windows Servers.
For Ubuntu, you can refer to
https://help.ubuntu.com/community/AutomaticSecurityUpdates for the automatic security patches only update via cron. But remember, updating security patches may requires downtime, especially for libraries because once libraries are loaded into the memory, changing the binaries will not affect loaded binaries.
For kernel patches, I ubuntu/debian can perform apt-get dist-upgrade, but you will need to restart the system eventually. For redhat based system, I believe you can do "yum update kernel".
Even so, from an operational standpoint, you will not want to do it lightly or without the necessary precautions, no matter how safe it may seems.You simply can't uninstall when it comes to kernel update. If your system stall, you will be in deep trouble.
I do not study into great depth on how the packages dependencies checking between RPM and DEB defers, but so far, both has been working rather fine.
