VPS & Server audit fixes

System Updates: fixing all 4 checks

The system updates audit measures how far behind a host is: how many packages are pending and how many are security fixes, whether they install themselves, and whether a reboot is still owed.

No check in this audit needs root, so a skip here is always a package-manager problem rather than a permission one: a dnf, yum or zypper check-update that exits with an error, typically an unreachable repository or a lapsed subscription, reports SKIP instead of a count, and a host with none of apt, dnf, yum, zypper or apk skips Pending Updates outright. Alpine skips Automatic Security Updates by design, because it ships no unattended-upgrade daemon at all.

4
checks in this audit
1
rated high severity
0
need root or sudo
~8s
automated run time

Transcribed from the vps-security-system-updates audit script. For what the audit covers rather than how to fix it, see the System Updates checklist.

Every check

Find your finding

Listed in the order the audit runs them. Take the check name from the third field of the result line and open its page.

  • Pending Updates

    Soon

    Checks for pending package updates, flagging security updates

    HighNo root4 results

  • Automatic Security Updates

    Soon

    Checks whether automatic security updates are configured and enabled

    MediumNo root4 results

  • Kernel Up To Date

    Soon

    Compares the running kernel against the latest installed kernel

    MediumNo root3 results

  • Reboot Required

    Soon

    Checks whether a reboot is pending to load updated kernel/libraries

    MediumNo root3 results
Shared script behaviour

How the System Updates audit reads your server

Every check in this audit runs after the same preamble, and several of its results only make sense once you know what that preamble could and could not see.

None need root.

Why checks skip

A SKIP is never a pass

A skipped check verified nothing at all. The most common cause is privilege: no check in this audit needs root, so a skip here means something else was missing. Before every run, each script works out which of four privilege modes it is in.

The four privilege modes an audit script can run in, and what each one means for checks that need root
ModeHow it is reachedWhat it means for your results
rootThe audit runs as UID 0.Every privileged branch runs directly. No check skips for lack of permission.
nopasssudo -n true succeeds, so the account has passwordless sudo.Privileged commands run through sudo -n.
passA sudo password was supplied in the CtrlOps audit settings and accepted.Privileged commands run through sudo -S.
noneNone of the above worked.CAN_ROOT=0. Every privileged branch returns SKIP with a "Need root" message rather than guessing.

If many checks skip with a “need root” message, run the audit as root, grant the audit account sudo (with or without NOPASSWD), or supply the sudo password in the CtrlOps audit settings.

Keep going

Related audits

FAQ

System Updates questions

The check runs apt-get -s upgrade, which simulates against the package lists from the last apt update, so a host whose lists are a week old gives you a week-old answer. Check the timestamps in /var/lib/apt/lists and let apt-daily.timer run, or refresh manually before auditing. Two other gaps explain most of the difference: it simulates upgrade rather than dist-upgrade, so packages that need new dependencies or removals are excluded, and held packages never appear.
Not necessarily. On Debian and Ubuntu the check confirms that unattended-upgrades is installed and that APT::Periodic::Unattended-Upgrade "1" appears somewhere under /etc/apt/apt.conf.d. It never looks at APT::Periodic::Update-Package-Lists, so a host that never refreshes its lists passes while upgrading nothing, and it does not confirm apt-daily-upgrade.timer is still enabled. On RHEL it accepts dnf-automatic.timer being enabled but never opens /etc/dnf/automatic.conf, where apply_updates = yes is the setting that actually applies anything.
The check compares uname -r against the newest kernel package installed, so the warning means a patched kernel is on disk and not yet running. Schedule the reboot rather than rushing it, but do not ignore it, because the fix for a kernel CVE only takes effect once the new image is loaded. Two hosts warn forever and are worth recognising: an Ubuntu box with both HWE and GA kernels installed, where the version sort always picks the HWE one even if you deliberately pinned the GA kernel, and a livepatch or kpatch host, which runs an older uname -r with patched code that the check cannot see.
Audit your fleet

Run all 4 System Updates checks, in one click

CtrlOps runs this audit over your existing SSH connection - no agents, no scripts to manage. $7/user/month after a 1 month free trial - no credit card required.

✓ Start instantly·✓ No credit card·✓ No sneaky autorenewals