{"id":169,"date":"2014-10-16T15:19:05","date_gmt":"2014-10-16T20:19:05","guid":{"rendered":"http:\/\/etapien.com\/guides\/?p=169"},"modified":"2020-08-24T14:22:20","modified_gmt":"2020-08-24T19:22:20","slug":"check-debian-installation-secure-update","status":"publish","type":"post","link":"https:\/\/etapien.com\/guides\/check-debian-installation-secure-update\/","title":{"rendered":"How to check that your Debian installation is secure after an update."},"content":{"rendered":"
\n

After the heartbleed <\/a>bug that made everyone upgrade their OpenSSL installations in fear of hackers getting access to login information I noticed that more and more comments with questions like \u201cDid you restart the service after you patched it?\u201d.<\/p>\n

Even\u00a0if running\u00a0apt-get update && apt-get upgrade on a regular basis some services actually DO need to be restarted to benefit from the update. If the service is not restarted it is still running on the old code and most likely still vulnerable.<\/p>\n

Debian has a nice app\u00a0to check which services that needs to be restarted after an update\/upgrade. It is called\u00a0checkrestart<\/b>\u00a0and should be run after installing security updates. Install the app and add it to the maintenance and security tasks right away!<\/p>\n

Installing is easy, run this command as root:<\/p>\n

\n
<\/div>\n
<\/div>\n
\n\n\n\n
\n
\n
1<\/div>\n<\/div>\n<\/td>\n
\n
\n
apt<\/span>–<\/span>get <\/span>install <\/span>debian<\/span>–<\/span>goodies<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

then check your status by running:<\/p>\n

\n
<\/div>\n
<\/div>\n
\n\n\n\n
\n
\n
1<\/div>\n<\/div>\n<\/td>\n
\n
\n
checkrestart<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

this is the result I got from one of my servers after the shell shock security<\/a> issue:<\/p>\n

\n
<\/div>\n
<\/div>\n
\n\n\n\n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n<\/div>\n<\/td>\n
\n
\n
root<\/span>@<\/span>ks3358984<\/span>:<\/span>\/<\/span>home<\/span>\/<\/span>mikho<\/span># checkrestart<\/span><\/div>\n
Found<\/span> 13<\/span> processes <\/span>using <\/span>old <\/span>versions <\/span>of <\/span>upgraded <\/span>files<\/span><\/div>\n
(<\/span>6<\/span> distinct <\/span>programs<\/span>)<\/span><\/div>\n
(<\/span>6<\/span> distinct <\/span>packages<\/span>)<\/span><\/div>\n
<\/div>\n
Of <\/span>these<\/span>,<\/span> 3<\/span> seem <\/span>to<\/span> contain <\/span>init <\/span>scripts <\/span>which <\/span>can <\/span>be <\/span>used <\/span>to<\/span> restart <\/span>them<\/span>:<\/span><\/div>\n
The <\/span>following <\/span>packages <\/span>seem <\/span>to<\/span> have <\/span>init <\/span>scripts <\/span>that <\/span>could <\/span>be <\/span>used<\/span><\/div>\n
to<\/span> restart <\/span>them<\/span>:<\/span><\/div>\n
openssh<\/span>–<\/span>server<\/span>:<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>18317<\/span>\u00a0\u00a0 <\/span>\/<\/span>usr<\/span>\/<\/span>sbin<\/span>\/<\/span>sshd<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>18319<\/span>\u00a0\u00a0 <\/span>\/<\/span>usr<\/span>\/<\/span>sbin<\/span>\/<\/span>sshd<\/span><\/div>\n
udev<\/span>:<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>2209<\/span>\u00a0\u00a0\u00a0\u00a0<\/span>\/<\/span>sbin<\/span>\/<\/span>udevd<\/span><\/div>\n
cron<\/span>:<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>3778<\/span>\u00a0\u00a0\u00a0\u00a0<\/span>\/<\/span>usr<\/span>\/<\/span>sbin<\/span>\/<\/span>cron<\/span><\/div>\n
<\/div>\n
These <\/span>are <\/span>the <\/span>init <\/span>scripts<\/span>:<\/span><\/div>\n
service <\/span>ssh <\/span>restart<\/span><\/div>\n
service <\/span>udev<\/span>–<\/span>mtab <\/span>restart<\/span><\/div>\n
service <\/span>udev <\/span>restart<\/span><\/div>\n
service <\/span>cron <\/span>restart<\/span><\/div>\n
<\/div>\n
These <\/span>processes <\/span>do<\/span> not<\/span> seem <\/span>to<\/span> have <\/span>an <\/span>associated <\/span>init <\/span>script <\/span>to<\/span> restart <\/span>them<\/span>:<\/span><\/div>\n
login<\/span>:<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>18326<\/span>\u00a0\u00a0 <\/span>\/<\/span>bin<\/span>\/<\/span>su<\/span><\/div>\n
bash<\/span>:<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>18320<\/span>\u00a0\u00a0 <\/span>\/<\/span>bin<\/span>\/<\/span>bash<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>18330<\/span>\u00a0\u00a0 <\/span>\/<\/span>bin<\/span>\/<\/span>bash<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n