Practical UNIX and Internet Security, 3rd Edition

Updating System Software

Several factors go into the selection of a particular Unix operating system or application and the choice of which version of the software to run, but we won’t try to get into those issues here.^[262] Once you’ve settled on which version of which software you’re going to install, however, it is imperative that you ensure that patches are available for all known security problems in the software, that you find those patches, and that you apply them. Similarly, once the system is up and running, you must be vigilant in learning about newly discovered security problems in your operating system and applications so you’ll be able to apply patches for them as they become available.

Installing a New Unix System

Because of the speed with which attackers discover new systems on the Internet, and the easy availability of attack scripts that can determine the operating system version of a remote Unix host and tailor its attacks against known bugs in that version, you must not put an unpatched Unix host onto the Internet in a way that makes it accessible to outsiders. Some commercial Unix vendors provide patch CD-ROMs quarterly on a subscription basis, but the very latest patches can usually be obtained only from the vendor’s web site.

The most secure way to patch a new installation is to download the patches to another computer that’s already connected to the Internet and updated with the latest security patches (perhaps a Mac or PC client that runs no server services). ...