[Solved] Updating via pacman -Syu

Astral Axiom · 2018-03-06 16:57:05

I am new to Arch, I just installed last night on my old Toshiba Satellite (one of the first to have UEFI bios, it is the latest version of bios for this system). I installed plasma-desktop and the minimal essentials, am using systemd-boot (not grub), tweaked it to my liking and have achieved silent boot via ArchWiki. Everything works and is fully updated currently. I am unclear on the update process though. When I run "pacman -Syu" the entire system is updated, if I understand correctly. I am a little unclear on the work around process If an update breaks something. "Partial updates are unsupported" is warned everywhere, what does that mean exactly? If there is news on a particular update that I feel will affect my system, does that mean that I should install it anyway and never exclude any updates in my pacman command? How does this work exactly?

Thanks so much:)

Last edited by Astral Axiom (2018-03-07 04:28:17)

Trilby · 2018-03-06 17:07:37

Astral Axiom wrote:

When I run "pacman -Syu" the entire system is updated, if I understand correctly.

Yes.

Astral Axiom wrote:

I am a little unclear on the work around process If an update breaks something.

You fix it

But really, there is no single answer to this. Downgrading may be an option, but there is not one-size fits all solution to troubleshooting: you must understand the trouble. But the forums are here to help if/when such things happen.

Astral Axion wrote:

"Partial updates are unsupported" is warned everywhere, what does that mean exactly?

This means you must update all packages (that have available updates) together. You can't, for example, decide you want to update plasma shell but avoid updates to some libraries. More common, though, this problem comes from the currently installed packages not being in sync with your local pacman database.

You can opt not to update for a while (but not too long) and skip many available updates. But what you can't do is update your pacman database (e.g. the -Sy flags) without also updating all the packages (the 'u' flag).

Astral Axiom wrote:

If there is news on a particular update that I feel will affect my system, does that mean that I should install it anyway and never exclude any updates in my pacman command? How does this work exactly?

Either install it anyway, or just don't update anything at all until you are ready. Again, there is no problem with just not updating for a bit and watching the activity on the forums. You can then update once the dust settles. But generally, if there is a news item, it will give step by step instructions on how to update without problems: follow those instructions.

How does it work to *not* exclude a package from an update? Easy: `pacman -Syu`.

Astral Axiom · 2018-03-06 17:16:04

Thanks so much, very informative and helpful.

So not updating "until the dust settles" is not a security risk? Don't the updates include important security updates, which is why we don't need anti-malware and anti-virus software with Linux vs. Windows?

loqs · 2018-03-06 17:33:02

Astral Axiom wrote:

So not updating "until the dust settles" is not a security risk?

If there is such an update is released since you have updated yes.

Astral Axiom wrote:

Don't the updates include important security updates,

Yes

which is why we don't need anti-malware and anti-virus software with Linux vs. Windows?

Attacks for linux are tailored to linux or OS agnostic such as browser addons.

Trilby · 2018-03-06 17:51:14

While I agree with loqs, I will present a different view:

Astral Axiom wrote:

So not updating "until the dust settles" is not a security risk?

It *may* be a security risk, but it's definitely not an issue for system maintenance: it's not a partial upgrade, it's not unsupported.

Now is it a security risk. This depends on what exactly is updated and whether or not your system would even be a potential target or not. If you are running a web server, then this could be a real problem - but given your description I'm quite sure you are not running a web server. For an ordinary system there are updates that improve security, but how often would it be a security catastrophe to wait a day or two ... none really.

Arch already gets security patches faster than nearly any other system out there. I don't think applying security updates is something to be taken lightly, but we do need to let reality enter in a bit here: none of us updates our system every 30 seconds, so all updates are delayed by some ammount of time. If you update weekly, then waiting an extra day or two isn't a problem you should worry about.

Applying an update that requires manual intervention that you don't feel comfortable with, in contrast, can pose a much more real threat to the stability of your system.

Arch is a fast moving ecosystem overall, but there is no harm in stopping to take a deep breath and ensure you know what's going on before you move forward.

Last edited by Trilby (2018-03-06 20:47:41)

loqs · 2018-03-06 17:59:34

I agree with Trilby also consider that a fully updated system can still be compromised if you do something such as running sshd with password authentication.
You could make it even easier for an attacker by using a dictionary or short password and allowing root login.
Edit:
grammar remove superfluous an

Last edited by loqs (2018-03-06 18:00:12)

Astral Axiom · 2018-03-06 18:22:56

Ok, I do not use browser addons or visit sketchy websites so I am good on that note. I have not used shh as I do not understand it fully yet. Since I have not installed anything to do with shh I am not vulnerable there right? I have made it necessary to provide root password for sudo commands, I am the only user, and my password is strong. So I should disallow root login, by that do you mean to edit "/etc/securetty" by uncommenting "#tty1"? Will that cause me to not be able to run sudo commands since sudo commands currently require the root password?

loqs · 2018-03-06 18:38:31

Astral Axiom wrote:

I have not used shh as I do not understand it fully yet. Since I have not installed anything to do with shh I am not vulnerable there right?

Correct as a more general note just installing a package on arch in general will not start its related services and unstarted services are again not a risk unless someone already has access to start the service or whatever it invokes.

Astral Axiom wrote:

I have made it necessary to provide root password for sudo commands, I am the only user, and my password is strong.

I was referring to configuration options for sshd which would be configured in /etc/ssh/sshd_config there are options that would only allow access by none root users and to allow access only via keys rather than passwords.
You uncommented the following in /etc/sudoers?

# Defaults targetpw  # Ask for the password of the target user
# ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'

Secure_Shell#Protection

Astral Axiom wrote:

So I should disallow root login, by that do you mean to edit "/etc/securetty" by uncommenting "#tty1"? Will that cause me to not be able to run sudo commands since sudo commands currently require the root password?

No if you wanted to disable root I would lock it using (not that I am recomending doing this)

#passwd -e 1 root

Edit:
clarify in general arch packages do not start services on installation without user configuration but there are exceptions.

Last edited by loqs (2018-03-06 18:39:56)

2ManyDogs · 2018-03-06 18:41:29

You are now asking questions that have nothing to do with the original title of your topic. I'd suggest reading these wiki topics:
https://wiki.archlinux.org/index.php/Security
https://wiki.archlinux.org/index.php/Sudo

Last edited by 2ManyDogs (2018-03-06 18:42:26)

Astral Axiom · 2018-03-06 18:56:06

In response to:
I was referring to configuration options for sshd which would be configured in /etc/ssh/sshd_config there are options that would only allow access by none root users and to allow access only via keys rather than passwords.
You uncommented the following in /etc/sudoers?

No, I added: "Defaults rootpw" to the end of "/etc/sudoers" when I uncommented "%wheel ALL=(ALL) ALL".

So do you not advise editing "/etc/securetty" by uncommenting "#tty1" and will it cause me to not be able to run sudo commands since I have added "Defaults rootpw" to "/etc/sudoers"?

this is the last question for this thread and I will mark it solved, once I figure out how to do that:)

Thanks so very much for all this informative and useful information and for the extraordinarily quick response times:)

loqs · 2018-03-06 19:07:27

Astral Axiom wrote:

So do you not advise editing "/etc/securetty" by uncommenting "#tty1" and will it cause me to not be able to run sudo commands since I have added "Defaults rootpw" to "/etc/sudoers"?

https://git.archlinux.org/svntogit/pack … dfb6f1a0aa
Please start a new thread about the issue. Above is /etc/securetty as supplied by the filesystem 2017.10-2

Arch Linux

#1 2018-03-06 16:57:05

[Solved] Updating via pacman -Syu

#2 2018-03-06 17:07:37

Re: [Solved] Updating via pacman -Syu

#3 2018-03-06 17:16:04

Re: [Solved] Updating via pacman -Syu

#4 2018-03-06 17:33:02

Re: [Solved] Updating via pacman -Syu

#5 2018-03-06 17:51:14

Re: [Solved] Updating via pacman -Syu

#6 2018-03-06 17:59:34

Re: [Solved] Updating via pacman -Syu

#7 2018-03-06 18:22:56

Re: [Solved] Updating via pacman -Syu

#8 2018-03-06 18:38:31

Re: [Solved] Updating via pacman -Syu

#9 2018-03-06 18:41:29

Re: [Solved] Updating via pacman -Syu

#10 2018-03-06 18:56:06

Re: [Solved] Updating via pacman -Syu

#11 2018-03-06 19:07:27

Re: [Solved] Updating via pacman -Syu

Board footer