Debian-Update Supported Best Practice

[Severin Meyer]

Unfortunately I cannot find an official documentation about supported debian update procedures.

If the setup was done from the 3CX-iso, debian will not install updates on its own.
The only way is to activate "3CX automatic updates".
As I understand, this will install 3CX-Updates for the current release (no automatic change from 16 to 18) and installs security updates if available.
So it is not possible (out of the box) to plan security updates on a daily base to prevent zero-day vulnerabilities in the operating system only and to delay 3CX-Updates.

So I will need to schedule my own update checks.
So for security updates this will be the following command

sudo unattended-upgrade

Also I would schedule updates of non security updates like this:

sudo apt-get update
sudo apt-upgrade

Are there any issues, when doing this, regarding supported state of the installation.
Are there limitations about which available update should not be installed to keep 3CX supported?

 

[Evolute IT]

Never EVER run "apt" on a 3CX ISO system. You'll break dependencies.

I believe that, even with Autoupdate disabled, it still installs the security updates in the background.

3CX manages the OS and upgrades it when needed. I wouldn't worry about it.

 

[Severin Meyer]

Never EVER run "apt" on a 3CX ISO system. You'll break dependencies.

I believe that, even with Autoupdate disabled, it still installs the security updates in the background.

3CX manages the OS and upgrades it when needed. I wouldn't worry about it.

Autoupdate disables security updates. Even when starting a 3CX-Update manually it will ignore security updates.

https://www.3cx.com/community/threa...lled-via-automatic-updating.79651/post-367011

As I understand, 3CX itself is using apt on autoupdates, so I think it should be some kind of safe.
But an official clarification would be helpful.

 

[Evolute IT]

Autoupdate disables security updates. Even when starting a 3CX-Update manually it will ignore security updates.

https://www.3cx.com/community/threa...lled-via-automatic-updating.79651/post-367011

As I understand, 3CX itself is using apt on autoupdates, so I think it should be some kind of safe.
But an official clarification would be helpful.

Then you have your answer.

And as I said, don't run APT manually. 3CX runs it with its dependencies in mind, so that everything is locked to a package version. If the system is modified, you're no longer supported.

 

[Severin Meyer]

Then you have your answer.

And as I said, don't run APT manually. 3CX runs it with its dependencies in mind, so that everything is locked to a package version. If the system is modified, you're no longer supported.

That's the reason why I need some official clarification to keep supported.
As in the linked post stated, SBCs are NEVER updated by 3CX, so at least these have to be done manually.
But there is no documentation how this can be done without breaking things.

 

[ChrisC_3CX]

That's the reason why I need some official clarification to keep supported.
As in the linked post stated, SBCs are NEVER updated by 3CX, so at least these have to be done manually.
But there is no documentation how this can be done without breaking things.

Regarding the 3CX PBX, installing Debian Security updates must be done via 3CX's "Automatic Update" feature. As Frederick mentioned, upgrading packages manually via the OS will very likely break dependencies and will render the deployment unsupported.

Regarding the 3CX SBC, for the time being you will have to keep it up to date manually until this is also implemented to be managed via 3CX. There is a slim chance dependencies might be affected here also but it is highly unlikely.

 

[Severin Meyer]

Regarding the 3CX PBX, installing Debian Security updates must be done via 3CX's "Automatic Update" feature. As Frederick mentioned, upgrading packages manually via the OS will very likely break dependencies and will render the deployment unsupported.

Regarding the 3CX SBC, for the time being you will have to keep it up to date manually until this is also implemented to be managed via 3CX. There is a slim chance dependencies might be affected here also but it is highly unlikely.

Can you please describe in detail how a manual update from a 3CX perspective should be done safely.

 

[ChrisC_3CX]

For the 3CX PBX it's as mentioned earlier, we recommend keeping the machine up to date only via 3CX's "Automatic Update" setting.

Regarding the 3CX SBC, since similar functionality has yet to be implemented, the safest way would be to perform the mentioned apt commands at a time during which downtime is tolerable, but you should always be prepared to re-deploy it using the 3CX ISO in the unlikely event that the updates/upgrades affect the SBC functionality.

 

[Severin Meyer]

Are there any plans to separate debian security updates from 3CX-Updates?
Or make a difference between zero-day updates and planned updates, as also a 3CX-Update could contain a zero-day vulnerability.
I would like to test plannable updates before deploying to prevent all customers calling for support the sam day.

 

[ChrisC_3CX]

As of yet there is no official information of such plans but do bear in mind that although the "Automatic Update" setting will install both Debian Security updates and 3CX service pack updates, they are separate in the sense that Debian security updates may be pushed out in between 3CX service pack updates.

 

[Severin Meyer]

As of yet there is no official information of such plans but do bear in mind that although the "Automatic Update" setting will install both Debian Security updates and 3CX service pack updates, they are separate in the sense that Debian security updates will get installed upon availability and will not have to wait for the next 3CX service pack update.

I'm aware, that on every updatecheck all available updates are installed.
(Still not clarified what happens from 16 to 18 in the future)
Therefore I need to set auto update to do it on a daily base, to get secured for zero-day bugs.

But this will result into "unplanned/untested" installation of 3CX-Updates which could be delayed without a security breach. There were some updates in the past which needed some work afterwards.
I would like to do these updates not for all customers at the same day.

Doesn't make my point of view sense?

 

[ChrisC_3CX]

Still not clarified what happens from 16 to 18 in the future

Do you mean if Automatic Updates will update the PBX from v16 to v18? If yes, the answer is, it will not. Major version updates are not carried out by the "Automatic Update" feature.

Therefore I need to set auto update to do it on a daily base, to get secured for zero-day bugs.

But this will result into "unplanned/untested" installation of 3CX-Updates which could be delayed without a security breach. There were some updates in the past which needed some work afterwards.
I would like to do these updates not for all customers at the same day.

Doesn't make my point of view sense?

I do see your point though one of the reasons updates are rolled out in a more controlled manner rather than pushing them out immediately upon availability is for us to also be able to test our software in conjunction with such updates to guarantee compatibility and to ensure 3CX PBX functionality.

 

[Severin Meyer]

I understand and I agree, that updates should be as stable and compatible as it can be.
Therefore I want also to delay "plannable" Updates, as there were problems in the past.

But there are more and more zero-day bugs on which a patch has to be applied as soon as possible.
Let's see the CVE-2021-33909 which came to attraction the past days.
Such a bug has to be fixed immediately. Even there is a risk of breaking the system.
I think it would be really risky to wait a week to install such patches based on a weekly updatecheck.

 

[ChrisC_3CX]

In such events, we do tend to prioritize updates/hot-fixes depending on the severity of the issue/vulnerability to maximize security and 3CX functionality, but, as mentioned previously we do have to first make sure we do not hinder 3CX in any way with such kinds of releases.

 

[SweetAction]

Based on this thread, the only way OS updates are applied by 3CX is when "auto-update" is turned on, correct? And there is no official way to apply updates manually?

What's the official path for those that are required to test updates before deploying and so keep auto-update off?

 

[NickD_3CX]

Based on this thread, the only way OS updates are applied by 3CX is when "auto-update" is turned on, correct? And there is no official way to apply updates manually?

What's the official path for those that are required to test updates before deploying and so keep auto-update off?

The people that would be testing the update prior to it being deployed to customers, I assume would usually be 3CX Partners.
Before each update for Final, we release it as a Beta for at least a week and 3CX Partners usually become aware of this.

To answer your question, you can test it using in your lab on your own 3CX installation by installing he Beta. If any problem is found, you can report it here in the forum and we shall take care of it before the said update goes final.