Security - Revision history

Holt at 07:50, 7 August 2024

2024-08-07T07:50:25Z

← Older revision		Revision as of 07:50, 7 August 2024
Line 6:		Line 6:
	#* https://github.com/iiab/iiab/tree/master/roles/iiab-admin		#* https://github.com/iiab/iiab/tree/master/roles/iiab-admin
	#* https://github.com/iiab/iiab-admin-console/blob/master/Authentication.md		#* https://github.com/iiab/iiab-admin-console/blob/master/Authentication.md
	# ''If OpenVPN is installed, [https://github.com/iiab/iiab/blob/master/roles/openvpn/tasks/install.yml developers' ssh keys are also installed] to enable remote login, for remote support during Beta programs and similar. You can disable this feature by running: <code>sudo rm -f /root/.ssh/authorized_keys</code>. NOTE: If you later ask Internet-in-a-Box to reinstall OpenVPN, please note that developer keys will be reinstalled.''		# ''If OpenVPN is installed, [https://github.com/iiab/iiab/blob/master/roles/openvpn/tasks/install.yml developers' ssh keys are also installed] to enable remote login, for remote support during Beta programs and similar. You can disable this feature by running:'' <code>sudo rm -f /root/.ssh/authorized_keys</code>. ''NOTE: If you later ask Internet-in-a-Box to reinstall OpenVPN, please note that developer keys will be reinstalled.''
	# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme		# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme

Holt at 07:49, 7 August 2024

2024-08-07T07:49:28Z

← Older revision		Revision as of 07:49, 7 August 2024
Line 1:		Line 1:
	'''''Some security tips ~~— that will become more professional as time goes on~~:'''''		'''''Some security tips:'''''

	# Please confirm your '''[[FAQ#What_are_the_default_passwords%3F\|passwords are secured]]'''.		# Please confirm your '''[[FAQ#What_are_the_default_passwords%3F\|passwords are secured]]'''.
Line 42:		Line 42:
	== Security Blowback / Survival Tips ==		== Security Blowback / Survival Tips ==

	* ~~Please join the design discussion~~ "[https://github.com/iiab/iiab/issues/1516 Student Privacy / Medical Confidentiality best practices prior to copying/re-provisioning an IIAB"] ~~and help us refine [https://wiki.iiab.io/go/FAQ FAQ.IIAB.IO] entry~~ "[http://wiki.laptop.org/go/IIAB/FAQ#How_do_I_back_up%2C_shrink_%26_copy_IIAB_microSD_cards%3F How do I back up, shrink & copy IIAB microSD cards?]"		* If using an LMS, think carefully about "[https://github.com/iiab/iiab/issues/1516 Student Privacy / Medical Confidentiality best practices prior to copying/re-provisioning an IIAB"] in context with duplication techniques like "[http://wiki.laptop.org/go/IIAB/FAQ#How_do_I_back_up%2C_shrink_%26_copy_IIAB_microSD_cards%3F How do I back up, shrink & copy IIAB microSD cards?]" in [https://wiki.iiab.io/go/FAQ FAQ.IIAB.IO]
	<!--		<!--
	* If you notice Wikipedia-like items are no longer accessible from http://box.lan, try running the following as root, which is similar to http://box/admin '''> Install Content > Restart Kiwix Server''':		* If you notice Wikipedia-like items are no longer accessible from http://box.lan, try running the following as root, which is similar to http://box/admin '''> Install Content > Restart Kiwix Server''':

Holt: /* OS "apt" Updates */

2024-08-07T07:45:09Z

OS "apt" Updates

← Older revision		Revision as of 07:45, 7 August 2024
Line 9:		Line 9:
	# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme		# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme

	== OS ~~"apt"~~ Updates ==		== OS, Bootloader and Firmware Updates ==

	* Several in our Internet-in-a-Box (IIAB) community choose to run the following quasi-weekly:		* Several in our Internet-in-a-Box (IIAB) community choose to run the following quasi-weekly:
Line 16:		Line 16:
	apt dist-upgrade (or "apt upgrade" if you do not want a new kernel etc)		apt dist-upgrade (or "apt upgrade" if you do not want a new kernel etc)
	apt clean (may be more comprehensive than "apt autoclean")		apt clean (may be more comprehensive than "apt autoclean")
			apt autoremove (remove packages that were auto-installed to satisfy dependencies, but are no longer needed)
	<!--		<!--
	* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":		* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":
Line 24:		Line 25:

	He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!) -->		He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!) -->

	* Finally, remove packages that were auto-installed to satisfy dependencies, but are no longer needed:

	~~apt autoremove<!-- (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of August 2024) -->~~

	* Raspberry Pi 4, Raspberry Pi 5 and Raspberry Pi 400: Raspberry Pi OS automatically updates the bootloader for important bug fixes. If however manually updating the bootloader or changing the boot order proves necessary, consider [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#imager Raspberry Pi Imager], [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspi-config raspi-config], or [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#update-the-bootloader-configuration rpi-eeprom-update].		* Raspberry Pi 4, Raspberry Pi 5 and Raspberry Pi 400: Raspberry Pi OS automatically updates the bootloader for important bug fixes. If however manually updating the bootloader or changing the boot order proves necessary, consider [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#imager Raspberry Pi Imager], [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspi-config raspi-config], or [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#update-the-bootloader-configuration rpi-eeprom-update].

Holt: /* OS "apt" Updates */

2024-08-07T07:42:30Z

OS "apt" Updates

← Older revision		Revision as of 07:42, 7 August 2024
Line 14:		Line 14:

	apt update		apt update
	apt dist-upgrade (or "apt~~-get~~ upgrade" if you do not want a new kernel etc)		apt dist-upgrade (or "apt upgrade" if you do not want a new kernel etc)
	apt clean (may be more comprehensive than "apt~~-get~~ autoclean")		apt clean (may be more comprehensive than "apt autoclean")
	<!--		<!--
	* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":		* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":
Line 31:		Line 31:
	* Raspberry Pi 4, Raspberry Pi 5 and Raspberry Pi 400: Raspberry Pi OS automatically updates the bootloader for important bug fixes. If however manually updating the bootloader or changing the boot order proves necessary, consider [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#imager Raspberry Pi Imager], [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspi-config raspi-config], or [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#update-the-bootloader-configuration rpi-eeprom-update].		* Raspberry Pi 4, Raspberry Pi 5 and Raspberry Pi 400: Raspberry Pi OS automatically updates the bootloader for important bug fixes. If however manually updating the bootloader or changing the boot order proves necessary, consider [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#imager Raspberry Pi Imager], [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspi-config raspi-config], or [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#update-the-bootloader-configuration rpi-eeprom-update].

	* Upgrading Raspberry Pi firmware [https://www.raspberrypi.com/documentation/computers/os.html#upgrade-your-firmware not recommended] as the <code>rpi-update</code> command can be dangerous~~, and~~ it's far safer to wait for the version of Raspberry Pi OS (available using the <code>apt</code> commands above).		* Upgrading Raspberry Pi firmware is [https://www.raspberrypi.com/documentation/computers/os.html#upgrade-your-firmware not recommended] as the <code>rpi-update</code> command can be dangerous — it's far safer to wait for the next version of Raspberry Pi OS (available using the <code>apt</code> commands above).
	<!-- == For CentOS and Fedora servers ==		<!-- == For CentOS and Fedora servers ==

Holt at 07:25, 7 August 2024

2024-08-07T07:25:05Z

Holt: /* Security Blowback / Survival Tips */

2024-08-07T06:18:31Z

Security Blowback / Survival Tips

← Older revision		Revision as of 06:18, 7 August 2024
Line 44:		Line 44:
	== Security Blowback / Survival Tips ==		== Security Blowback / Survival Tips ==

	* Please join the design discussion "[https://github.com/iiab/iiab/issues/1516 Student Privacy / Medical Confidentiality best practices prior to copying/re-provisioning an IIAB"] and help us refine ~~http~~://FAQ.IIAB.IO entry "[http://wiki.laptop.org/go/IIAB/FAQ#How_do_I_back_up.2C_shrink_.26_copy_IIAB_microSD_cards.3F How do I back up, shrink & copy IIAB microSD cards?]"		* Please join the design discussion "[https://github.com/iiab/iiab/issues/1516 Student Privacy / Medical Confidentiality best practices prior to copying/re-provisioning an IIAB"] and help us refine [https://wiki.iiab.io/go/FAQ FAQ.IIAB.IO] entry "[http://wiki.laptop.org/go/IIAB/FAQ#How_do_I_back_up%2C_shrink_%26_copy_IIAB_microSD_cards%3F How do I back up, shrink & copy IIAB microSD cards?]"
			<!--
	* If you notice Wikipedia-like items are no longer accessible from http://box.lan, try running the following as root, which is similar to ~~the~~ http://box/admin -> Install Content -> "Restart Kiwix Server~~" button~~:		* If you notice Wikipedia-like items are no longer accessible from http://box.lan, try running the following as root, which is similar to http://box/admin '''> Install Content > Restart Kiwix Server''':

	iiab-make-kiwix-lib		iiab-make-kiwix-lib
	systemctl restart kiwix-serve		systemctl restart kiwix-serve

	* If ownCloud updates itself to 8.1 or above, users visiting http://schoolserver.lan/owncloud from unknown IP addresses may face error message "You don't have permission to access /owncloud on this server." <strike>Fix guideline forthcoming from Tim Moody.</strike> NEW PROGNOSIS FEB 2017: Josh Dennis hopes to move IIAB to http://Nextcloud.com, which has stronger community support than ownCloud. Mnemonic http://box/docs stands to greatly ease field usage among young children and less literate teachers around the world.		* If ownCloud updates itself to 8.1 or above, users visiting http://schoolserver.lan/owncloud from unknown IP addresses may face error message "You don't have permission to access /owncloud on this server." <strike>Fix guideline forthcoming from Tim Moody.</strike> NEW PROGNOSIS FEB 2017: Josh Dennis hopes to move IIAB to http://Nextcloud.com, which has stronger community support than ownCloud. Mnemonic http://box/docs stands to greatly ease field usage among young children and less literate teachers around the world. -->

Holt: /* For Debian, Raspberry Pi OS and Ubuntu servers */

2024-08-07T06:09:54Z

For Debian, Raspberry Pi OS and Ubuntu servers

← Older revision		Revision as of 06:09, 7 August 2024
Line 21:		Line 21:
	apt update		apt update
	apt full-upgrade (similar to above "apt-get dist-upgrade")		apt full-upgrade (similar to above "apt-get dist-upgrade")
	apt~~-get~~ clean (may be more comprehensive than "apt-get autoclean")		apt clean (may be more comprehensive than "apt-get autoclean")

	He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!)		He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!)
Line 27:		Line 27:
	* Whichever path you take above, the final step is optional — to remove packages that were auto-installed to satisfy dependencies, but are no longer needed:		* Whichever path you take above, the final step is optional — to remove packages that were auto-installed to satisfy dependencies, but are no longer needed:

	apt autoremove (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of ~~May 2017~~)		apt autoremove (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of August 2024)

	* In the distant past, "rpi-update" was also required to update firmware on Raspberry Pi SD cards.		* In the distant past, "rpi-update" was also required to update firmware on Raspberry Pi SD cards.

Holt at 21:31, 22 November 2021

2021-11-22T21:31:15Z

← Older revision		Revision as of 21:31, 22 November 2021
Line 1:		Line 1:
	'''''Some security tips — that will become more professional as time goes on:'''''		'''''Some security tips — that will become more professional as time goes on:'''''

	# Please confirm your '''[[~~../~~FAQ#What_are_the_default_passwords.3F\|passwords are secured]]'''.		# Please confirm your '''[[FAQ#What_are_the_default_passwords.3F\|passwords are secured]]'''.
	# Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your server, and are willing to take certain risks with packages/versions occasionally/potentially colliding.		# Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your server, and are willing to take certain risks with packages/versions occasionally/potentially colliding.
	# Please read more about the 'iiab-admin' Linux user and group, which allow you to log in to IIAB's Admin Console:		# Please read more about the 'iiab-admin' Linux user and group, which allow you to log in to IIAB's Admin Console:

Holt: Created page with "'''''Some security tips — that will become more professional as time goes on:''''' # Please confirm your '''passwords are secured'''. # Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your server, and are willing to take certain risks with packages/versions occasionall..."

2021-11-22T21:30:02Z

Created page with "'''''Some security tips — that will become more professional as time goes on:''''' # Please confirm your '''[[../FAQ#What_are_the_default_passwords.3F|passwords are secured]]'''. # Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your server, and are willing to take certain risks with packages/versions occasionall..."

New page

'''''Some security tips — that will become more professional as time goes on:'''''

# Please confirm your '''[[../FAQ#What_are_the_default_passwords.3F|passwords are secured]]'''.
# Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your server, and are willing to take certain risks with packages/versions occasionally/potentially colliding.
# Please read more about the 'iiab-admin' Linux user and group, which allow you to log in to IIAB's Admin Console:
#* https://github.com/iiab/iiab/tree/master/roles/iiab-admin
#* https://github.com/iiab/iiab-admin-console/blob/master/Authentication.md
# ''If OpenVPN is installed, [https://github.com/iiab/iiab/blob/master/roles/openvpn/tasks/main.yml developers' ssh keys are also installed] to enable remote login, for remote support during Beta programs and similar. You can disable this feature by running: "sudo rm -f /root/.ssh/authorized_keys". NOTE: If you later ask Internet-in-a-Box to reinstall OpenVPN, please note that developer keys will be reinstalled.''
# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme

== For Debian, Raspberry Pi OS and Ubuntu servers ==

* Several in our Internet-in-a-Box (IIAB) community choose to run the following quasi-weekly:

apt update
apt dist-upgrade (or "apt-get upgrade" if you do not want a new kernel etc)
apt clean (may be more comprehensive than "apt-get autoclean")

* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":

apt update
apt full-upgrade (similar to above "apt-get dist-upgrade")
apt-get clean (may be more comprehensive than "apt-get autoclean")

He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!)

* Whichever path you take above, the final step is optional — to remove packages that were auto-installed to satisfy dependencies, but are no longer needed:

apt autoremove (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of May 2017)

* In the distant past, "rpi-update" was also required to update firmware on Raspberry Pi SD cards.

== For CentOS and Fedora servers ==

* Run <code>[http://www.cyberciti.biz/faq/redhat-fedora-centos-linux-yum-installs-security-updates/ yum -y update --security]</code> if your system already has yum-security installed, typically via <code>[https://access.redhat.com/solutions/10021 yum install yum-security]</code> (this appears preinstalled within CentOS 7.x). Be warned that --security unfortunately updates very few packages, and is not prompt in updating (administrators may prefer to run "yum update openssl", "yum update openvpn" and similar frequently, to stay up-to-date with critical CentOS ESR packages/services).

* Please also consider commands:
** yum updateinfo list security all
** yum updateinfo list security installed
** yum updateinfo list security available

* Many with high-bandwidth run more complete system updates, as follows: <code>yum update</code> or <code>yum -y update</code> (followed by <code>yum clean all</code> among those who were daring). Even if arguably this installs far too many untested and diverse updates/upgrades across the board, adding too many features not directly related to security. However this is still the way to go IF you want ALL packages updated (and are willing to face many unintended consequences, with a professional Linux administration staff to recover!)

== Security Blowback / Survival Tips ==

* Please join the design discussion "[https://github.com/iiab/iiab/issues/1516 Student Privacy / Medical Confidentiality best practices prior to copying/re-provisioning an IIAB"] and help us refine http://FAQ.IIAB.IO entry "[http://wiki.laptop.org/go/IIAB/FAQ#How_do_I_back_up.2C_shrink_.26_copy_IIAB_microSD_cards.3F How do I back up, shrink & copy IIAB microSD cards?]"

* If you notice Wikipedia-like items are no longer accessible from http://box.lan, try running the following as root, which is similar to the http://box/admin -> Install Content -> "Restart Kiwix Server" button:

iiab-make-kiwix-lib
systemctl restart kiwix-serve

* If ownCloud updates itself to 8.1 or above, users visiting http://schoolserver.lan/owncloud from unknown IP addresses may face error message "You don't have permission to access /owncloud on this server." <strike>Fix guideline forthcoming from Tim Moody.</strike> NEW PROGNOSIS FEB 2017: Josh Dennis hopes to move IIAB to http://Nextcloud.com, which has stronger community support than ownCloud. Mnemonic http://box/docs stands to greatly ease field usage among young children and less literate teachers around the world.

← Older revision		Revision as of 07:25, 7 August 2024
Line 1:		Line 1:
	'''''Some security tips — that will become more professional as time goes on:'''''		'''''Some security tips — that will become more professional as time goes on:'''''

	# Please confirm your '''[[FAQ#What_are_the_default_passwords.3F\|passwords are secured]]'''.		# Please confirm your '''[[FAQ#What_are_the_default_passwords%3F\|passwords are secured]]'''.
	# Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your ~~server~~, and are willing to take certain risks with packages/versions occasionally/potentially colliding.		# Consider the strategies below to help secure your OS (downloading and/or semi-automatically installing recent security patches & updates). That is IF you find a reasonably fast Internet connection for your IIAB, and are willing to take certain risks with packages/versions occasionally/potentially colliding.
	# Please read more about the 'iiab-admin' Linux user and group, which allow you to log in to IIAB's Admin Console:		# Please read more about the <code>iiab-admin</code> Linux user and group, which allow you to log in to IIAB's Admin Console:
	#* https://github.com/iiab/iiab/tree/master/roles/iiab-admin		#* https://github.com/iiab/iiab/tree/master/roles/iiab-admin
	#* https://github.com/iiab/iiab-admin-console/blob/master/Authentication.md		#* https://github.com/iiab/iiab-admin-console/blob/master/Authentication.md
	# ''If OpenVPN is installed, [https://github.com/iiab/iiab/blob/master/roles/openvpn/tasks/~~main~~.yml developers' ssh keys are also installed] to enable remote login, for remote support during Beta programs and similar. You can disable this feature by running: "sudo rm -f /root/.ssh/authorized_keys". NOTE: If you later ask Internet-in-a-Box to reinstall OpenVPN, please note that developer keys will be reinstalled.''		# ''If OpenVPN is installed, [https://github.com/iiab/iiab/blob/master/roles/openvpn/tasks/install.yml developers' ssh keys are also installed] to enable remote login, for remote support during Beta programs and similar. You can disable this feature by running: <code>sudo rm -f /root/.ssh/authorized_keys</code>. NOTE: If you later ask Internet-in-a-Box to reinstall OpenVPN, please note that developer keys will be reinstalled.''
	# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme		# If you use Samba file sharing, see also: https://github.com/iiab/iiab/tree/master/roles/samba#samba-readme

	== ~~For Debian, Raspberry Pi~~ OS ~~and Ubuntu servers~~ ==		== OS "apt" Updates ==

	* Several in our Internet-in-a-Box (IIAB) community choose to run the following quasi-weekly:		* Several in our Internet-in-a-Box (IIAB) community choose to run the following quasi-weekly:
Line 16:		Line 16:
	apt dist-upgrade (or "apt-get upgrade" if you do not want a new kernel etc)		apt dist-upgrade (or "apt-get upgrade" if you do not want a new kernel etc)
	apt clean (may be more comprehensive than "apt-get autoclean")		apt clean (may be more comprehensive than "apt-get autoclean")
			<!--
	* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":		* In February 2017, [http://lists.laptop.org/pipermail/server-devel/2017-February/008085.html James Cameron] suggested some may prefer to use "apt" instead of "apt-get":

Line 23:		Line 23:
	apt clean (may be more comprehensive than "apt-get autoclean")		apt clean (may be more comprehensive than "apt-get autoclean")

	He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!)		He mentions there's a package for automated unattended upgrades, called [https://wiki.debian.org/UnattendedUpgrades "unattended-upgrades"] for those who require that (and are willing to bear the risks!) -->

	* ~~Whichever path you take above~~, ~~the final step is optional — to~~ remove packages that were auto-installed to satisfy dependencies, but are no longer needed:		* Finally, remove packages that were auto-installed to satisfy dependencies, but are no longer needed:

	apt autoremove (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of August 2024)		apt autoremove<!-- (some consider this last step risky, though no known IIAB/XSCE problems have resulted as of August 2024) -->

	* In the ~~distant past~~, "rpi-update~~" was also required to update firmware on Raspberry Pi SD cards~~.		* Raspberry Pi 4, Raspberry Pi 5 and Raspberry Pi 400: Raspberry Pi OS automatically updates the bootloader for important bug fixes. If however manually updating the bootloader or changing the boot order proves necessary, consider [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#imager Raspberry Pi Imager], [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#raspi-config raspi-config], or [https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#update-the-bootloader-configuration rpi-eeprom-update].

	== For CentOS and Fedora servers ==		* Upgrading Raspberry Pi firmware [https://www.raspberrypi.com/documentation/computers/os.html#upgrade-your-firmware not recommended] as the <code>rpi-update</code> command can be dangerous, and it's far safer to wait for the version of Raspberry Pi OS (available using the <code>apt</code> commands above).
			<!-- == For CentOS and Fedora servers ==

	* Run <code>[http://www.cyberciti.biz/faq/redhat-fedora-centos-linux-yum-installs-security-updates/ yum -y update --security]</code> if your system already has yum-security installed, typically via <code>[https://access.redhat.com/solutions/10021 yum install yum-security]</code> (this appears preinstalled within CentOS 7.x). Be warned that --security unfortunately updates very few packages, and is not prompt in updating (administrators may prefer to run "yum update openssl", "yum update openvpn" and similar frequently, to stay up-to-date with critical CentOS ESR packages/services).		* Run <code>[http://www.cyberciti.biz/faq/redhat-fedora-centos-linux-yum-installs-security-updates/ yum -y update --security]</code> if your system already has yum-security installed, typically via <code>[https://access.redhat.com/solutions/10021 yum install yum-security]</code> (this appears preinstalled within CentOS 7.x). Be warned that --security unfortunately updates very few packages, and is not prompt in updating (administrators may prefer to run "yum update openssl", "yum update openvpn" and similar frequently, to stay up-to-date with critical CentOS ESR packages/services).
Line 40:		Line 41:
	** yum updateinfo list security available		** yum updateinfo list security available

	* Many with high-bandwidth run more complete system updates, as follows: <code>yum update</code> or <code>yum -y update</code> (followed by <code>yum clean all</code> among those who were daring). Even if arguably this installs far too many untested and diverse updates/upgrades across the board, adding too many features not directly related to security. However this is still the way to go IF you want ALL packages updated (and are willing to face many unintended consequences, with a professional Linux administration staff to recover!)		* Many with high-bandwidth run more complete system updates, as follows: <code>yum update</code> or <code>yum -y update</code> (followed by <code>yum clean all</code> among those who were daring). Even if arguably this installs far too many untested and diverse updates/upgrades across the board, adding too many features not directly related to security. However this is still the way to go IF you want ALL packages updated (and are willing to face many unintended consequences, with a professional Linux administration staff to recover!) -->

	== Security Blowback / Survival Tips ==		== Security Blowback / Survival Tips ==