Subject: How to keep Alpine-based systems secure

From: "[email-masked]" <[email-masked]>
Date: Wed, 18 Dec 2019 15:24:52 +0000 (UTC)

Hi, I would like to keep my systems secure. And I wonder how it can be done with Alpine Linux.

I tried to find something. Is there anything new regarding https://lists.alpinelinux.org/~alpine/users/%3CCAKXJ0%3Di57cR-9ORP2%3DA-_c0nQPR17twKULskqVQL3Lwo_JuPLg%40mail.gmail.com%3E ?

I tried to ask also others, but I've got no helpful answer. https://serverfault.com/questions/992400/how-to-get-information-about-security-updates-for-alpine-linux 

What would you suggest? Or what is the procedure that you use?

-- 
Wojciech Kopras

---

From: PICCORO McKAY Lenz <[email-masked]>
Date: Wed, 18 Dec 2019 16:39:43 -0400

maybe you must sear at alpine irc channel or
https://gitlab.alpinelinux.org/alpine

but GUYS THE MAN HAVE A POINT HERE! where it's the security channel
for alpine linux?

Lenz McKAY Gerardo (PICCORO)
http://qgqlochekone.blogspot.com

---

From: Natanael Copa <[email-masked]>
Date: Thu, 19 Dec 2019 11:53:26 +0100

On Wed, 18 Dec 2019 16:39:43 -0400

> but GUYS THE MAN HAVE A POINT HERE! where it's the security channel

Where is the volunteer to set up and manage the security channel? We
need someone that can help us set it up and manage it.

Meanwhile, you can follow the RSS feed from gitlab (follow closed
issues with label T-security):

https://gitlab.alpinelinux.org/alpine/aports/issues.atom?label_name%5B%5D=T-Security&scope=all&state=closed&utf8=%E2%9C%93

---

From: PICCORO McKAY Lenz <[email-masked]>
Date: Thu, 19 Dec 2019 11:33:29 -0400

> https://gitlab.alpinelinux.org/alpine/aports/issues.atom?label_name%5B%5D=T-Security&scope=all&state=closed&utf8=%E2%9C%93

HEY NATHANIEL the RSS can be  parsed and showed as a list of articles
in the main side of alpine linux! please can some one setuyp a rss
parser to the web page and show as security information page?

wheantime, i'll create a security information page in the wiki and
also open a issue request for

> need someone that can help us set it up and manage it.

What are the rules to maintain a/the security channel? maybe not me
only, i already also know another guy that can do it alongside !

interesting..  https://gitlab.alpinelinux.org/alpine/aports/issues?scope=all&utf8=%E2%9C%93&state=closed&label_name[]=T-Security

---

From: Wojciech Kopras <[email-masked]>
Date: Mon, 23 Dec 2019 15:10:23 +0000 (UTC)

For me the option with an RSS feed is a good option. Thank you.

RSS: https://gitlab.alpinelinux.org/alpine/aports/issues?state=closed&label_name%5B%5D=T-Security

Adding that information to wiki - IMHO a great idea. Issues with the "T-Security" label can be your "security channel".

-- 
Wojciech Kopras

---

From: Wojciech Kopras <[email-masked]>
Date: Tue, 24 Dec 2019 08:17:28 +0000 (UTC)

Sorry, I've made a mistake in the URL that could mislead someone reading the thread. The correct version is:

RSS: https://gitlab.alpinelinux.org/alpine/aports/issues.atom?state=closed&label_name%5B%5D=T-Security

List of issues in GitLab: https://gitlab.alpinelinux.org/alpine/aports/issues?state=closed&label_name%5B%5D=T-Security

-- 
Wojciech Kopras

---

From: Natanael Copa <[email-masked]>
Date: Thu, 19 Dec 2019 11:37:34 +0100

> What would you suggest? Or what is the procedure that you use?

To keep your machine updated run `apk upgrade -U -a` regularily. Stable
branches should only have bug fixes and security fixes, so in theory
you could run this from a cron job. You can do this with `apk add apk-cron`.

There are tools that will tell you what services needs to be restarted after an update.
See https://github.com/jirutka/apk-autoupdate (this is in testing still)

If you want check what is going to be updated then you can do:

  apk update && apk version

It will tell you what packages that are outdated and needs update.
After that you can run `apk upgrade`.

If you only want follow security issues (with a CVE), then you can
follow isses in our bugtracker:

https://gitlab.alpinelinux.org/alpine/aports/issues?scope=all&utf8=%E2%9C%93&state=closed&label_name[]=T-Security

Note that we keep those confidential til they are solved so you need to
follow the closed ones.

You can also get this as a RSS feed (click at the "subscribe RSS feed"
button left to "Edit issues" and "New issue" buttons).

The url is:

I hope this helps til we have a proper security announcement channel.

Thanks!

-nc