Your submission was sent successfully! Close

Thank you for contacting us. A member of our team will be in touch shortly. Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Livepatch Security Hardening

This page provides recommendations on how to setup Livepatch Server’s deployment to improve security.

Infrastructure Setup

Independently from the method you have chosen to deploy Livepatch Server you should have:

Component Exposure Notes
livepatch client API livepatch clients Endpoints potentially exposed to internet.
livepatch server API livepatch clients Endpoints potentially exposed to internet.
livepatch server Admin API livepatch admins Endpoints exposed to few authorized users.
postgresql livepatch server Service exposed to a segregated internal network.
patch storage livepatch server Service exposed to a segregated internal network.
patch server livepatch clients Endpoints potentially exposed to internet.

You can follow this guide on how to setup your infrastracture using Juju.

Authentication

We discuss authentication in detail on this page.
In summary, admins use basic auth (username and password) to authenticate, while Livepatch client use on of the token-based mechanisms.

Admin authentication: when you setup Livepatch Admin Tool be sure to use a strong password and you should protect hosts where the Livepatch Admin Tool is used.

Client authentication: when you register a client, a token is stored on the machine running the client. Ensure only authorized users have sudo access to the host.

Communication

TLS is a key factor, especially for those components exposed to the internet.
Below we explain how to enable TLS for each component of Livepatch.

Livepatch Server

Livepatch server is the core component serving APIs. You should enable TLS for the Livepatch Server to ensure integrity and confidentiality of communication with Livepatch clients and the Livepatch Admin Tool.

To enable TLS for the charmed Livepatch Server, you can follow this guide.

Additionally, you should put in place networking rules to only allow admin API access from specific IP addresses (ex. company internal network).

PostgreSQL

PostgreSQL is where state to operate Livepatch Server is stored. It should be in a segregated network to prevent external access but TLS can be enabled to ensure confidentiality and integrity.

To enable TLS for charmed Postgresql you can follow this guide.

As of October 2024, you need to manually restart the Livepatch Server if you enable TLS on Postgres after having related Livepatch and Postgres charms.

Patch Storage

Patch storage is the place where the Livepatch Server stores the actual patch files and it should be in a segregated network to prevent external access. Still, TLS can be enabled to ensure confidentiality and integrity.
You can choose between multiple solutions.

Patch Server

Patch Server is the component in charge of serving the actual patch files. It can be the Livepatch server itself, or an external service. TLS is recommended to ensure confidentiality and integrity.

Another Livepatch Server

It is possible to chain multiple Livepatch Servers, as described in this guide.
They exchange tiers and patch information, and TLS can be enabled to ensure confidentiality and integrity.

To enable TLS for the charmed Livepatch Server, you can follow this guide.

This page was last modified 26 days ago. Help improve this document in the forum.