blog.bythewood.me-flask

 1---
 2title: Minimal automated updates for Alpine Linux
 3slug: minimal-automated-updates-for-alpine-linux
 4date: 2022-07-16
 5publish_date: 2022-07-16
 6tags: security, sysadmin
 7description: Many Linux distros have a way to configure automated updates but somewhat surprisingly Alpine Linux does not.
 8cover_image: alpine-linux.webp
 9---
10
11Alpine Linux does run a hardened kernel, I always add a firewall to my servers, lock down SSH access to my IP address, and follow various other server security best practices so I shouldn't have any security problems but I do like to keep things updated.
12
13I've found a very straight forward way of keeping my Alpine Linux servers up-to-date. For every new Alpine Linux server I make I always create a simple shell script in my `/etc/periodic/daily/` folder named `apk-autoupgrade` with the permissions `700`:
14
15```shell
16#!/bin/sh
17apk upgrade --update | sed "s/^/[`date`] /" >> /var/log/apk-autoupgrade.log
18```
19
20You can create this yourself or run the following to create it in a single command:
21
22```shell
23echo -e "#!/bin/sh\napk upgrade --update | sed \"s/^/[\`date\`] /\" >> /var/log/apk-autoupgrade.log" > /etc/periodic/daily/apk-autoupgrade && \
24	chmod 700 /etc/periodic/daily/apk-autoupgrade
25```
26
27Your Alpine Linux server now auto-updates itself, assuming you have cron jobs running. You can also enable those easily with:
28
29```shell
30apk add crond && \
31	rc-service crond start && \
32    rc-update add crond
33```
34
35What my script does is run the command `apk upgrade --update` once a day. Luckily `apk` by default never asks for user input so it should always just work. The rest of the script is to help you out by providing some logging. You can check the `/var/log/apk-autoupgrade.log` file every now and then to make sure everything is running smoothly. As an example of the output here's one of my servers:
36
37```shell
38[Wed Jul  6 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/APKINDEX.tar.gz
39[Wed Jul  6 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/community/x86_64/APKINDEX.tar.gz
40[Wed Jul  6 02:00:00 UTC 2022] (1/4) Upgrading libcrypto1.1 (1.1.1p-r0 -> 1.1.1q-r0)
41[Wed Jul  6 02:00:00 UTC 2022] (2/4) Upgrading libssl1.1 (1.1.1p-r0 -> 1.1.1q-r0)
42[Wed Jul  6 02:00:00 UTC 2022] (3/4) Upgrading openssl (1.1.1p-r0 -> 1.1.1q-r0)
43[Wed Jul  6 02:00:00 UTC 2022] (4/4) Upgrading openssl-doc (1.1.1p-r0 -> 1.1.1q-r0)
44[Wed Jul  6 02:00:00 UTC 2022] Executing busybox-1.35.0-r14.trigger
45[Wed Jul  6 02:00:00 UTC 2022] Executing ca-certificates-20211220-r0.trigger
46[Wed Jul  6 02:00:00 UTC 2022] OK: 512 MiB in 253 packages
47[Thu Jul  7 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/APKINDEX.tar.gz
48[Thu Jul  7 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/community/x86_64/APKINDEX.tar.gz
49[Thu Jul  7 02:00:00 UTC 2022] OK: 512 MiB in 253 packages
50[Fri Jul  8 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/main/x86_64/APKINDEX.tar.gz
51[Fri Jul  8 02:00:00 UTC 2022] fetch http://dl-cdn.alpinelinux.org/alpine/latest-stable/community/x86_64/APKINDEX.tar.gz
52[Fri Jul  8 02:00:00 UTC 2022] (1/1) Upgrading sgdisk (1.0.9-r1 -> 1.0.9-r2)
53[Fri Jul  8 02:00:00 UTC 2022] Executing busybox-1.35.0-r14.trigger
54[Fri Jul  8 02:00:00 UTC 2022] OK: 512 MiB in 253 packages
55```
56
57The one thing this script doesn't do is restart services once they are updated so that's something you'll need to determine yourself. In the future I may expand upon the script by checking for kernel updates or updates to running services and reboot the system or the service based off of the log output. As of right now I automatically reboot my servers every Sunday night since reboots happen almost instantly. If I hear of something critical then I'll just run a quick manual reboot.
58
59That's it, a minimal solution to keep your Alpine Linux systems updated.