How KernelCare Protects Your Server

One of the most important things you can do to ensure the security and stability of your Linux server is to keep the kernel updated. Some Kernel updates patch security vulnerabilities and other issues. Kernel patches are released as issues are discovered.

Unless you are regularly checking for kernel updates, or your notified of a security issue, you may not be aware when a kernel update is available. Additionally, since updating the kernel traditionally requires a reboot, the prospect of associated downtime often prevents the updates from being applied as quickly as they should be.

KernelCare changes all that.

Automatic Updates; No Reboot Necessary

KernelCare is a CloudLinux product that automatically updates the Linux kernel to address security and stability issues without the need for a server reboot, even during its initial install. You can read more on KernelCare in our article: What Is KernelCare?

Liquid Web provides KernelCare on all new managed Storm® and Dedicated servers running a supported operating system (CentOS 5, 6, and 7, which also may report as “Derived From Red Hat Enterprise Linux”; or CloudLinux 5 and 6). Moreover, as part of Liquid Web’s proactive response to security concerns, KernelCare has been applied to nearly all existing Fully Managed servers running a supported operating system.

What Does It Mean For You?

KernelCare runs transparently on your server. There are no settings you need to configure nor commands that need to be run once installed. KernelCare will regularly check for kernel updates and automatically apply them as they become available with no impact on your server or services.

With KernelCare you never have to worry if your server’s kernel is protected against a particular vulnerability. You know it is. You never have to worry about downtime caused by rebooting to apply a kernel patch; cause there is none. And you never have to worry about how long you’ll have to wait for a new patch to be applied to your server. KernelCare offers the most efficient protection by automatically updating the kernel as soon as a patch is available, with no need for a reboot.

===

Liquid Web’s Heroic Support is always available to assist customers with this or any other issue. If you need our assistance please contact us:
Toll Free 1.800.580.4985
International 517.322.0434
support@liquidweb.com
https://manage.liquidweb.com/

What Is KernelCare?

Tux the Penguin with Hotpatching (KernelCare)The concept of ‘Kernel hotpatching’, sometimes called live patching, was introduced to the Linux community around 2008. Soon after groups began developing differing implementations of the concept. KernelCare, one of the more popular implementations, was originally released in March 2014 by Cloud Linux, Inc.

So, what does hot patching do? (Or: Why do I want KernelCare?)

The basic concept of Linux kernel hot patching is pretty much the same not matter what it’s called. The goal is to only update the changes rather than the whole Kernel – which normally requires a reboot. It’s much harder than it sounds though since kernel updates come as complete packages and the system is running.

Imagine trying to do an oil change on your car while driving at highway speeds; that’s kernel hot patching in a nutshell.

With a KernelCare enabled kernel updates can be processed and then applied selectively to a running server. This can mean not needing to reboot for much longer than you would normally require to stay secure.

How do I check if I have KernelCare and is it working? (Or: Checking KernelCare version)

The best way to check if your server is running with KernelCare is to look for its main CLI tool. You can do this with the following linux command:

which kcarectl

If the CLI tool is found on the server you will see output like the following, or something very similar.

# which kcarectl
/usr/bin/kcarectl

If the CLI tool is not installed you will see the following:

# which kcarectl
#
When using the Linux `which` command you will get no results if the executable is not found. In this case that means KernelCare is likely not active or installed on the server.

Assuming the test above was successful, you’ll now want to check the status of KernelCare. This will help you determine if KernelCare is active and what the effective version is. You can do this with the following command:

/usr/bin/kcarectl --info

The results will look similar to the following:

[root@host ~]# /usr/bin/kcarectl –info
kpatch-state: patch is applied
kpatch-for: Linux version 3.10.0-327.36.3.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) ) #1 SMP Mon Oct 24 16:09:20 UTC 2016
kpatch-build-time: Mon Nov 7 08:20:19 2016
kpatch-description: 2;3.10.0-327.36.3.el7.x86_64

As you can see the output provides various details about the KernelCare status. Looking at the kpatch-state we can see that hot patching is working and enabled.