mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
Merge pull request #4709 from Yinux/master
翻译完成，Livepatch – Apply Critical Security Patches to Ubuntu Linux Kernel Without Rebooting ，目录已更改
This commit is contained in:
VicYu
GitHub
commit
ce2dad34be
@ -1,101 +0,0 @@
|
||||
Yinux 翻译中
|
||||
Livepatch – Apply Critical Security Patches to Ubuntu Linux Kernel Without Rebooting
|
||||
============================================================
|
||||
|
||||
If you are a system administrator in charge of maintaining critical systems in enterprise environments, we are sure you know two important things:
|
||||
|
||||
1) Finding a downtime window to install security patches in order to handle kernel or operating system vulnerabilities can be difficult. If the company or business you work for does not have security policies in place, operations management may end up favoring uptime over the need to solve vulnerabilities. Additionally, internal bureaucracy can cause delays in granting approvals for a downtime. Been there myself.
|
||||
|
||||
2) Sometimes you can’t really afford a downtime, and should be prepared to mitigate any potential exposures to malicious attacks some other way.
|
||||
|
||||
The good news is that Canonical has recently released (actually, a couple of days ago) its Livepatchservice to apply critical kernel patches to Ubuntu 16.04 (64-bit edition / 4.4.x kernel) without the need for a later reboot. Yes, you read that right: with Livepatch, you don’t need to restart your Ubuntu 16.04 server in order for the security patches to take effect.
|
||||
|
||||
### Signing up for Ubuntu Livepatch
|
||||
|
||||
In order to use Canonical Livepatch Service, you need to sign up at [https://auth.livepatch.canonical.com/][1] and indicate if you are a regular Ubuntu user or an Advantage subscriber (paid option). All Ubuntu users can link up to 3 different machines to Livepatch through the use of a token:
|
||||
|
||||
[
|
||||
|
||||
][2]
|
||||
|
||||
Canonical Livepatch Service
|
||||
|
||||
In the next step you will be prompted to enter your Ubuntu One credentials or sign up for a new account. If you choose the latter, you will need to confirm your email address in order to finish your registration:
|
||||
|
||||
[
|
||||
|
||||
][3]
|
||||
|
||||
Ubuntu One Confirmation Mail
|
||||
|
||||
Once you click on the link above to confirm your email address, you’ll be ready to go back to [https://auth.livepatch.canonical.com/][4] and get your Livepatch token.
|
||||
|
||||
### Getting and Using your Livepatch Token
|
||||
|
||||
To begin, copy the unique token assigned to your Ubuntu One account:
|
||||
|
||||
[
|
||||
|
||||
][5]
|
||||
|
||||
Canonical Livepatch Token
|
||||
|
||||
Then go to a terminal and type:
|
||||
|
||||
```
|
||||
$ sudo snap install canonical-livepatch
|
||||
```
|
||||
|
||||
The above command will install the livepatch, whereas
|
||||
|
||||
```
|
||||
$ sudo canonical-livepatch enable [YOUR TOKEN HERE]
|
||||
```
|
||||
|
||||
will enable it for your system. If this last command indicates it can’t find canonical-livepatch, make sure `/snap/bin` has been added to your path. A workaround consists of changing your working directory to `/snap/bin` and do.
|
||||
|
||||
```
|
||||
$ sudo ./canonical-livepatch enable [YOUR TOKEN HERE]
|
||||
```
|
||||
[
|
||||
|
||||
][6]
|
||||
|
||||
Install Livepatch in Ubuntu
|
||||
|
||||
Overtime, you’ll want to check the description and the status of patches applied to your kernel. Fortunately, this is as easy as doing.
|
||||
|
||||
```
|
||||
$ sudo ./canonical-livepatch status --verbose
|
||||
```
|
||||
|
||||
as you can see in the following image:
|
||||
|
||||
[
|
||||
|
||||
][7]
|
||||
|
||||
Check Livepatch Status in Ubuntu
|
||||
|
||||
Having enabled Livepatch on your Ubuntu server, you will be able to reduce planned and unplanned downtimes at a minimum while keeping your system secure. Hopefully Canonical’s initiative will award you a pat on the back by management – or better yet, a raise.
|
||||
|
||||
Feel free to let us know if you have any questions about this article. Just drop us a note using the comment form below and we will get back to you as soon as possible.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/livepatch-install-critical-security-patches-to-ubuntu-kernel
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[Yinux](https://github.com/Yinux)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:https://auth.livepatch.canonical.com/
|
||||
[2]:http://www.tecmint.com/wp-content/uploads/2016/10/Canonical-Livepatch-Service.png
|
||||
[3]:http://www.tecmint.com/wp-content/uploads/2016/10/Ubuntu-One-Confirmation-Mail.png
|
||||
[4]:https://auth.livepatch.canonical.com/
|
||||
[5]:http://www.tecmint.com/wp-content/uploads/2016/10/Livepatch-Token.png
|
||||
[6]:http://www.tecmint.com/wp-content/uploads/2016/10/Install-Livepatch-in-Ubuntu.png
|
||||
[7]:http://www.tecmint.com/wp-content/uploads/2016/10/Check-Livepatch-Status.png
|
||||
@ -0,0 +1,98 @@
|
||||
Livepatch —— 免重启给 Ubuntu Linux 内核打关键性安全补丁
|
||||
============================================================
|
||||
|
||||
如果你是一个在企业环境中维护关键性系统的系统管理员,你肯定知道以下两件事：
|
||||
|
||||
1) 很难找个停机时间去给系统安装安全补丁以修复内核或者系统漏洞 。 如果你工作的公司或者企业没有适当的安全策略，运营管理可能最终会优先保证系统的运行而不是解决系统漏洞。 此外,内部的官僚机构也可能延迟批准停机时间。我当时就是这样的。
|
||||
|
||||
2) 有时候你确实负担不起停机造成的损失， 并且还要做好用别的什么方法减小恶意攻击带来的的风险的准备。
|
||||
|
||||
好消息是 Canonical 公司最近（事实上，几天前）针对 Ubuntu 16.04 (64位版本 / 4.4.x 内核) 发布了 Livepathservice ，一个不用重启就能给内核打关键性安全补丁的程序。 对，你没看错：用 Livepatch 你不用重启就能使 Ubuntu 16.04 服务器系统 的安全补丁生效。
|
||||
|
||||
### 注册 Ubuntu Livepatch 账号
|
||||
|
||||
要运行 Canonical Livepatch 服务你先要在这里注册一个账号 [https://auth.livepatch.canonical.com/][1] 并且指出你是一个普通用户还是企业用户（付费）。 通过令牌，所有的 Ubuntu 用户都能将最多3台不同的电脑连接到 Livepatch ：
|
||||
|
||||
[
|
||||
|
||||
][2]
|
||||
|
||||
Canonical Livepatch 服务
|
||||
下一步系统会提示你输入你的 Ubuntu One 凭据或者注册一个新账号.。如果你选择后者，则需要你确认你的邮件地址才能完成注册：
|
||||
|
||||
[
|
||||
|
||||
][3]
|
||||
|
||||
Ubuntu One 确认邮件
|
||||
|
||||
一旦你点了上面的链接确认了你的邮件地址，你就会回到这个界面 [https://auth.livepatch.canonical.com/][4] 并获取你的 Livepatch 令牌。
|
||||
|
||||
### 获取并使用 Livepatch 令牌
|
||||
|
||||
首先把分配给你账号的这个独一无二的令牌复制下来:
|
||||
|
||||
[
|
||||
|
||||
][5]
|
||||
|
||||
Canonical Livepatch 令牌
|
||||
|
||||
然后打开终端,输入:
|
||||
|
||||
```
|
||||
$ sudo snap install canonical-livepatch
|
||||
```
|
||||
|
||||
上面的命令会安装 livepach程序,下面的命令会为你的系统启用它。
|
||||
|
||||
```
|
||||
$ sudo canonical-livepatch enable [YOUR TOKEN HERE]
|
||||
```
|
||||
如果后一条的命令提示 找不到 canonical-livepatch ， 检查一下 `/snap/bin` 已经添加到你的路径， 或者把你的工作目录切换到 `/snap/bin` 执行也行。
|
||||
|
||||
```
|
||||
$ sudo ./canonical-livepatch enable [YOUR TOKEN HERE]
|
||||
```
|
||||
[
|
||||
|
||||
][6]
|
||||
|
||||
在 Ubuntu 中安装 Livepatch
|
||||
|
||||
以后你可能需要检查应用于内核的补丁的描述和状态。幸运的是，这很简单。
|
||||
|
||||
```
|
||||
$ sudo ./canonical-livepatch status --verbose
|
||||
```
|
||||
|
||||
如下图所示：
|
||||
|
||||
[
|
||||
|
||||
][7]
|
||||
|
||||
检查补丁安装情况
|
||||
|
||||
在你的Ubuntu服务器上启用了 Livepatch ,你就可以在保证系统安全的同时把计划内的外的停机时间降到最低。希望Canonical的这个举措会在管理上给你带来便利甚至更近一步带来进步。
|
||||
|
||||
如果你对这篇文章有什么疑问，欢迎在下面留言,我们会尽快回复。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/livepatch-install-critical-security-patches-to-ubuntu-kernel
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[Yinux](https://github.com/Yinux)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:https://auth.livepatch.canonical.com/
|
||||
[2]:http://www.tecmint.com/wp-content/uploads/2016/10/Canonical-Livepatch-Service.png
|
||||
[3]:http://www.tecmint.com/wp-content/uploads/2016/10/Ubuntu-One-Confirmation-Mail.png
|
||||
[4]:https://auth.livepatch.canonical.com/
|
||||
[5]:http://www.tecmint.com/wp-content/uploads/2016/10/Livepatch-Token.png
|
||||
[6]:http://www.tecmint.com/wp-content/uploads/2016/10/Install-Livepatch-in-Ubuntu.png
|
||||
[7]:http://www.tecmint.com/wp-content/uploads/2016/10/Check-Livepatch-Status.png
|
||||
Loading…
Reference in New Issue
Block a user