0

I am looking for some PowerShell command which can check if any update/patch need to be applied to existing Azure Linux VM and then apply the patch if required. I will then use this PowerShell command to automate the process.

There was an extension but that appears to be outdated now.

3

Apologies for not directly answering your question, but by the sounds of your question, you are trying to build an update management system to mitigate the threats of vulnerable operating system components and tools having unpatched vulnerabilities which expose you to risk.

This functionality is actually already available for both Windows and Linux via Azure Automation in the form of the unimaginatively named Update Management solution.

Essentially you will need to do the following:

  1. Configure Azure Monitor and Log Analytics to provide information about vulnerable packages on your machines,
  2. Ensure that any network security groups and firewalls are configured to allow access to/from the various components of the system,
  3. Enable Change Tracking and Inventory,
  4. Enable Update Management,
  5. Onboard your machines.

I would also highly recommend employing Azure Security Center as this provides a clearer overview of vulnerabilities across your estate, not just as applied to specific virtual machines.

2
  • Thanks Richard , I already tried update management solution but i want some kind of unattended updates. I came across a module at help.ubuntu.com/lts/serverguide/automatic-updates.html . I haven't tried it yet but do you think it will do the same thing and update security patches unattended. – rdhaundiyal Oct 26 '19 at 21:26
  • The only thing you can do is give it a try, I would still use Azure Security Center to provide a layer of reporting over and above what is offered by that automatic-updates service. I would also consider spreading the update frequency amongst multiple machines so that they don't all restart on the same schedule. – Richard Slater Oct 30 '19 at 9:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.