At what point is a Streisand instance too old?

[josephlhall]

I realize Streisand automates security updates, but is there any maintenance operators should do or anything to freshen the feature set of an old instance?

[alimakki]

Streisand's unattended upgrades will auto update what Ubuntu considers critical/security updates, as well as a handful of projects (Tor, Nginx, OpenVPN, shadowsocks-libev see [this].

OCServ, and LibreSwan are compiled from source and as far as I can tell there's no auto-update for either; they must be done manually if there's a need. Wireguard is the latest addition to Streisand however as far as I can tell it is not part of any auto update mechanism.

From what I gather these would be the 3 tools that may/could need maintenance if there was a concern, or alternatively wipe it and start fresh.

[josephlhall]

Thank you! It might be good to keep a MAINTENANCE.txt file or something in the root that detailed this... happy to propose a PR along what @alimakki says.

[lazerhawk]

What about older Streisand instances that were built on Ubuntu 14, considering we are now at 16? Security updates won't do distro updates.

I guess since the basic policy of Streisand is disposable instances, the usual course of action is to spin up a new instance with a newer Streisand version?

[josephlhall]

and if so, can it tell you when you need to peel off and stand up a more recent instance?

…

On Fri, Mar 17, 2017 at 1:00 AM, lazerhawk ***@***.***> wrote: What about older Streisand instances that were built on Ubuntu 14, considering we are now at 16? Security updates won't do distro updates. I guess since the basic policy of Streisand is disposable instances, the usual course of action is to spin up a new instance with a newer Streisand version?

[pchaganti]

👍

[alimakki]

@lazerhawk older instances may pose a problem. To illustrate my point, I'm still running a DigitalOcean VPS based on Ubuntu 14; recently the shadowsocks debian repo went offline, and this essentially broke unattended upgrades as apt would halt execution once it hit a 404 on the said repo.

Removing shadowsocks from the apt configuration resolved the problem, however it presented a risk since security upgrades were no longer being applied because of the dead repository.

Another example is when Streisand switched OpenVPN repositories to use the 2.4 branch instead of the 2.3. Unless you manually change that, you would not receive the latest features for that particular tool.

Also to take into consideration how many people use your gateway. If you're the only user there wouldn't be much friction in spawning a new server, in my case however I have a lot of relatives that now depend on it to circumvent VoIP censorship in the Arabian Gulf, thus making me apprehensive in spawning a new server and distributing new certificates.

To answer your question as to when an instance can get too old is a bit subjective and depends on your use case and threat model.

If you do plan on rotating, in my opinion every 4-6 months seems reasonable.

[cpu]

Thank you! It might be good to keep a MAINTENANCE.txt file or something in the root that detailed this... happy to propose a PR along what @alimakki says.

This sounds like a great idea 👍

[josephlhall]

Apologies for opening this back up... I should probably just ask @cpu very nicely via other means!

When I SSH into my instance it says:

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

160 packages can be updated.
3 updates are security updates.

And I'd like to apply any updates that might not be happening automatically (I could just rev the server but I'm not in a good place to do that for some days).

When I apt-get upgrade I do get a bunch of cruft about ShadowSocks, so I'm not sure if I should try and garden this instance or just pull it down and rev. Any advice appreciated.

[tiliarou]

I'm not sure where to ask but my ubuntu server 16.04.5 LTS is suggesting to upgrade to 18.04.1 LTS, would that be safe to do for my streisand setup ?