Hacker News Reader

Comment by fulafel | Hacker News Reader

PSA: A RPi running Pi-hole is not a fire-and-forget item. The networked software on it, including pi-hole, sometimes has security holes discovered and exploited, and has to be kept up to date. See eg https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi... & https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491... & https://www.cvedetails.com/vulnerability-list.php?vendor_id=... (afaik Pi-hole is built on dnsmasq)

View on HN

Setting up automatic updates is probably a good idea.

Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?

I run this on a cron to auto update PiHole:

    #!/bin/sh

    LOG_FILE=/var/log/update_pihole.log

    echo "Starting upate" >> $LOG_FILE
    date >> $LOG_FILE
    pihole -up >> $LOG_FILE
    pihole -g >> $LOG_FILE

    exit 0

The default way would be to install the package unattendedupgrade which will install security updates on your system every day.

Depending on how pihole is installed, this may not upgrade it. I personally have it installed with docker and uses watchtower for updates, but the risk with this mechanism is that it can break things.

I've been using: https://www.reddit.com/r/pihole/comments/bgzvem/how_to_healt... for upgrading + healthchecks

However note that the developers of PiHole do not recommend automated upgrades, or at least be aware of the implications

I've set a cron job on the raspberry pi at my parents' house. It's a debian based system with only PiHole running so I just pihole -up and apt update && upgrade every month or so.

I don’t see the issue with this? Anyone who’s able to install Pihole in the first place will be more than capable of keeping the system up to date. I’d generally trust the underlying software and the maintainers to address security issues in a timely manner, security vulnerabilities on home routers on the other hand...

Installing PiHole is copy pasting a shell script. Raspi is introducing a lot of new users to the linux community.

Reply on news.ycombinator.com